Open OAuth tools

Security

Security policy

OAuth Hub handles client secrets and tokens, so vulnerability reports are taken seriously. Here is how to send one, and how the service protects credentials today.

Last updated 29 September 2026

Report a vulnerability

Email security@oauthhub.com. Please include the affected URL or endpoint, the steps to reproduce it, and the impact you observed. A machine-readable contact is published at /.well-known/security.txt.

Never include real client secrets, tokens, or authorization codes in a report. Use test apps and redact any credential values.

Reports will be acknowledged, and you'll be kept informed while a fix is prepared. Please give reasonable time for a fix before disclosing publicly.

Safe harbour

Security research on OAuth Hub that follows this policy is authorised. OAuth Hub will not start or support legal action against you for accidental, good-faith breaches of this policy. If a third party takes action against you over research that followed this policy, OAuth Hub will make it known that your work complied with it.

This authorisation covers only OAuth Hub's own systems. It cannot authorise testing of third-party systems (see Scope), and it does not bind third parties or law-enforcement authorities.

Scope

  • In scope: oauthhub.com, www.oauthhub.com, and their /api/* endpoints.
  • Out of scope: third-party providers' own systems, the hosting and DNS platforms, social engineering, and physical attacks.

Testing rules

  • Use only your own test apps, shops, and credentials.
  • Do not run denial-of-service or high-volume tests. The API is rate limited, and bulk traffic gets blocked.
  • Do not access, change, or keep other people's data. Stop and report as soon as you reach it.
  • Do not use the Shopify domain finder to reach internal or non-public addresses beyond what is needed to show an issue.

How credentials are protected

  • Credentials pass through in memory for a single request. They are never stored, and never written to logs or error reports.
  • Error reports have request bodies, headers, and cookies removed, and credential-shaped values redacted.
  • OAuth state is generated on the server, random, single-use, HTTP-only, and expires after 10 minutes.
  • Every response carries a strict Content Security Policy, HSTS, clickjacking protection, and other hardening headers.
  • API endpoints are rate limited, reject request bodies over 16KB, and enforce timeouts and size limits on provider responses.
  • The Shopify domain finder fetches only public addresses. It re-checks DNS on every redirect and caps redirects, response size, and time.
  • Browser storage only ever holds non-secret convenience fields.