I'm not pretty sure, but if my app is enabled to Client Side Flow Authentication, then anyone with my client ID (easily found for being embedded or by sniffing the initial request) would be able to ask for new access tokens for users that had already allowed my app.
If I'm right in this assumption, than wouldn't Client Side Flow expose a big security vulnerability? Which point am I missing? How would I make it more secure without needing to create a server to deal with authentication?