Hi Ryan,

You are correct.

The client_secret is *never* sent to any end-user. In some cases, the access_token and the id_token are sent to the end-user...

Thanks! I'll take some time to update the diagram!