This is a self-hosted SSO. A real vulnerability here could affect someone's live login system, so don't open a public GitHub issue for one.

To report something: open a private GitHub security advisory on this repo, or reach out via github.com/realunfazed. Useful to include:

• what you found and roughly why it's exploitable
• steps to reproduce, if you have them
• what the fixed behavior should look like

I'll try to respond and get a fix out quickly. Give it a reasonable amount of time before disclosing publicly.

This is a personal project, maintained best-effort, not a professionally audited product. It's been built and reviewed carefully (see the security notes in the README), but it hasn't had a formal third-party audit. Treat it accordingly: fine for personal projects and small tools, and use your own judgment about anything higher-stakes than that.