require-oauth-scopes

Requires non-empty scope arrays whenever an OAuth2 or OpenID Connect scheme appears in a root or operation security requirement.

Attribute	Value
Category	Security
Maturity	Platinum
Lenient–Strict	Warning
Complete	Error

See it fail

security:
  - oauth: []

Fix it

security:
  - oauth: [payments:read]

This rule checks scope presence, not whether each scope is declared by the scheme.

Nearby: security-defined, security-scheme-oauth2.