Google OAuth2.0 allows users NOT in list of test users
I'm developing a webapp which allows users to log in with their Google accounts, using OAuth2.0. I've created an OAuth2.0 client ID, configured the OAuth consent screen with the Publishing status set to 'Testing', and added a test user. The frontend of my app is built with React, and I'm using a package (react-google-login) to handle the flow. I can successf