OAuthLint 0.11.0

OAuthLint now covers C# and ASP.NET Core. The same low-false-positive OAuth, OIDC and JWT linting, now for .NET. 12 new rules, validated at zero false positives on real .NET auth libraries. The pack is now 184 rules across 6 languages.

Added

• C# / ASP.NET Core support: 12 new rules for the auth mistakes AI tools commonly ship in .NET services:
  • JWT bearer validation turned off (signature, audience, lifetime or issuer)
  • Hard-coded signing keys and OAuth client secrets
  • Insecure transport (HTTPS metadata off, PKCE disabled)
  • Insecure auth cookies and over-permissive CORS
  • TLS certificate validation disabled
• Tuned to flag your app's configuration, not the frameworks it uses, so it stays quiet on OIDC servers like OpenIddict and IdentityServer. (#134)

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.11.0	npm
oauthlint-rules	0.8.0	npm
oauthlint-mcp	0.2.3	npm
VS Code extension	0.7.0	Marketplace (auspeo.oauthlint-vscode)
GitHub Action	v1.10.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.11.0        # or: npx oauthlint@0.11.0 scan .

Browse the rules at https://oauthlint.dev/rules/ · Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.10.2...oauthlint@0.11.0