Function oauth_base 

pub fn oauth_base() -> String

Where the device flow’s endpoints live: github.com, unless NOMOREIDE_GITHUB_OAUTH_BASE names a loopback address.

The same rule crate::github_manager::api_base follows, and for the same reason: the second of these two calls returns a token, so an override free to name any host would be a way to feed this machine someone else’s credential — or to collect the one it asked for.