Hmm....🚨 OAuth vs Email Signup Conflict — Security or Bad UX? (Need your opinion)

Hello guys,
This is my first post. Apologies if any mistake is there.

So in the morning i came across this git issue on the appwrite git repo #11908.

🧪 Scenario
A user signs up using Google OAuth ([e-mail])
Then tries to sign up again using email/password (account.create())

🤔 Expected Behavior
Appwrite should return:

{
  "message": "A user with the same id, email, or phone already exists in this project.",
  "code": 409,
  "type": "user_already_exists"
}

😕 Actual Behavior
Instead, it returns:

{
  "message": "There was an error processing your request.",
  "code": 400,
  "type": "general_bad_request"
}

🧠 What's Going On?

In the codebase, this seems intentional:
“Return a generic bad request to prevent exposing existing accounts”
So this is clearly a security decision to avoid account enumeration.

BUT…

⚖️ The Inconsistency

If a user signs up normally (email/password) and tries again →
Appwrite does return 409 user_already_exists

So:

Case Response
Email → Email again 409 (explicit)
OAuth → Email 400 (generic)

This means:
👉 Enumeration is already possible
👉 But UX is bad only in OAuth cases

💥 Why This Matters

For real apps:

Users get confused (“Did I already sign up?”)
No clear path to login instead
Poor first impression of auth flow

❓ The Real Question

What should be the correct behavior here?

Option A — Security First 🔒
Always return generic errors (400)
➡️ Prevents enumeration, but hurts UX

Option B — Consistency + UX 👍
Always return 409 user_already_exists
➡️ Better UX, but leaks account existence

Option C — Smarter Approach 🧠
Return 409
BUT guide user: “Try logging in with Google”
Or auto-link identities
💬 I’d Love Your Thoughts
How do you handle this in your apps?
Is account enumeration still a real concern here?
Should OAuth + email accounts be auto-linked?

Let’s discuss 👇