To read relevant links and commentary, please see these two OAuth and OpenID Connect email threads:
If anyone thinks we need to add something beyond our current security considerations, it would be good to open a new issue and propose a severity level.

Eve Maler
Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl