We audited passport-openidconnect, openid-client, and auth0-spa-js against the full OAuth 2.1 threat model. Two shipped mitigations we couldn't verify. One quietly disabled at_hash validation in v4.2. Here's the tape.
We audited passport-openidconnect, openid-client, and auth0-spa-js against the full OAuth 2.1 threat model. Two shipped mitigations we couldn't verify. One quietly disabled at_hash validation in v4.2. Here's the tape.
zitadel/oidc's minimal attack surface, exhaustive test coverage against the RFC 6749 corpus, and a maintainer who replies on weekends make it our first recommendation for new Go projects.
The module is functional but its defaults belong in a museum. We document 3 practical CSRF variants that survive typical middleware stacks. Migrate, or harden aggressively.
age has a small surface, honest documentation, and a scheme that has survived real-world use. Our only gripe is key-file ergonomics — an interface problem, not a cryptographic one.
Legacy versions accept untrusted secret-key inputs that collide trivially with attacker-chosen algorithms. A one-line upgrade fixes it. Your excuse runs out here.
lucia-auth ships a well-documented threat model and defaults that embody it. A mid-release scope change introduced one rough edge around adapter contracts; otherwise, read the code and sleep well.
Security is not a product. It is a relationship between authors, maintainers, packagers, and the engineers who trust them by accident every morning.
secnull exists because that trust is usually misplaced — and because refusing to name names is a kind of complicity we can no longer afford.
No mailing list yet — follow the RSS feed for new dispatches.