<titledata-react-helmet="true">Security | OAuth2 Proxy</title><metadata-react-helmet="true"name="twitter:card"content="summary_large_image"><metadata-react-helmet="true"name="docusaurus_language"content="en"><metadata-react-helmet="true"name="docusaurus_version"content="current"><metadata-react-helmet="true"name="docusaurus_tag"content="docs-default-current"><metadata-react-helmet="true"property="og:title"content="Security | OAuth2 Proxy"><metadata-react-helmet="true"name="description"content="OAuth2 Proxy is a community project."><metadata-react-helmet="true"property="og:description"content="OAuth2 Proxy is a community project."><metadata-react-helmet="true"property="og:url"content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security"><linkdata-react-helmet="true"rel="shortcut icon"href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><linkdata-react-helmet="true"rel="canonical"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/community/security"><linkrel="stylesheet"href="/oauth2-proxy/styles.58710d0f.css">
Maintainers do not work on this project full time, and as such,
while we endeavour to respond to disclosures as quickly as possible,
this may take longer than in projects with corporate sponsorship.</p></div></div><h2><aaria-hidden="true"tabindex="-1"class="anchor enhancedAnchor_2cZh"id="security-disclosures"></a>Security Disclosures<aaria-hidden="true"tabindex="-1"class="hash-link"href="#security-disclosures"title="Direct link to heading">#</a></h2><divclass="admonition admonition-important alert alert--info"><divclass="admonition-heading"><h5><spanclass="admonition-icon"><svgxmlns="http://www.w3.org/2000/svg"width="14"height="16"viewBox="0 0 14 16"><pathfill-rule="evenodd"d="M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"></path></svg></span>important</h5></div><divclass="admonition-content"><p>If you believe you have found a vulnerability within OAuth2 Proxy or any of its
dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
any details publicly.</p></div></div><p>Security disclosures MUST be done in private.
If you have found an issue that you would like to bring to the attention of the
maintenance team for OAuth2 Proxy, please compose an email and send it to the
list of maintainers in our <ahref="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS"target="_blank"rel="noopener noreferrer">MAINTAINERS</a> file.</p><p>Please include as much detail as possible.
Ideally, your disclosure should include:</p><ul><li>A reproducible case that can be used to demonstrate the exploit</li><li>How you discovered this vulnerability</li><li>A potential fix for the issue (if you have thought of one)</li><li>Versions affected (if not present in master)</li><li>Your GitHub ID</li></ul><h3><aaria-hidden="true"tabindex="-1"class="anchor enhancedAnchor_2cZh"id="how-will-we-respond-to-disclosures"></a>How will we respond to disclosures?<aaria-hidden="true"tabindex="-1"class="hash-link"href="#how-will-we-respond-to-disclosures"title="Direct link to heading">#</a></h3><p>We use <ahref="https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories"target="_blank"rel="noopener noreferrer">GitHub Security Advisories</a>
to privately discuss fixes for disclosed vulnerabilities.
If you include a GitHub ID with your disclosure we will add you as a collaborator
for the advisory so that you can join the discussion and validate any fixes
we may propose.</p><p>For minor issues and previously disclosed vulnerabilities (typically for
dependencies), we may use regular PRs for fixes and forego the security advisory.</p><p>Once a fix has been agreed upon, we will merge the fix and create a new release.
If we have multiple security issues in flight simultaneously, we may delay
merging fixes until all patches are ready.
We may also backport the fix to previous releases,
