Only the latest published minor release line receives security fixes.

If you discover a security vulnerability, please report it via GitHub's private vulnerability reporting feature. Do not open a public issue.

Please include:

• A description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact

We aim to acknowledge reports within 48 hours and release a fix within 90 days. We will coordinate with you before any public disclosure.

• Auth endpoints: Production introspection and authorization endpoints must use HTTPS and service-specific credentials. The local URLs in AuthConfig and the examples are development defaults.
• Session secrets: Set a strong, unique state_cookie_secret in every environment. Do not deploy placeholder or example secrets.
• Vault tokens: VaultConfig defaults to http://localhost:8200 with token root — these are development defaults and must be overridden in production.
• CORS: The example applies a permissive CorsLayer for local development. Do not copy this to production without restriction.