Skip to content

OAuthLint 0.14.0

Choose a tag to compare

View all tags
@Mauriceanney Mauriceanney released this 12 Aug 10:45
· 2 commits to main since this release
oauthlint@0.14.0
d035a89

OAuthLint now covers mobile: Swift/iOS and Android. The same low-false-positive linting, now for the auth mistakes AI assistants ship in mobile apps. 18 new rules for iOS (Swift, Vapor) and Android (Kotlin and the manifest/config XML), validated at zero false positives on AppAuth-iOS and AppAuth-Android. The pack is now 271 rules.

Added

  • Swift / iOS (8 rules):
    • Tokens stored in UserDefaults / @AppStorage instead of the Keychain, and insecure Keychain accessibility (kSecAttrAccessibleAlways).
    • OAuth run in an in-app WKWebView (a phishing surface), and a non-ephemeral ASWebAuthenticationSession.
    • Hard-coded credentials, plus Vapor server checks: a hard-coded JWT HMAC key and wildcard CORS with credentials.
  • Android (10 rules):
    • Kotlin: tokens in SharedPreferences instead of EncryptedSharedPreferences, OAuth in a WebView, cleartext (http://) auth endpoints, a trust-all onReceivedSslError, hard-coded secrets, and PKCE explicitly disabled in AppAuth.
    • Android XML: usesCleartextTraffic="true" in the manifest, hard-coded secrets in strings.xml, cleartext permitted in a network-security-config, and an exported activity claiming an OAuth redirect.
  • Every mobile rule is a plain, low-false-positive pattern, scoped by the exact API and by key/URL names, and validated at zero false positives against the reference OAuth clients (AppAuth-iOS, AppAuth-Android).
  • The VS Code extension and the pre-commit hook now scan Swift and Android XML too.

Ships in this release

Component Version Where
oauthlint (CLI) 0.14.0 npm
oauthlint-rules 0.11.0 npm
oauthlint-mcp 0.2.6 npm
VS Code extension 0.10.0 Marketplace (auspeo.oauthlint-vscode) + Open VSX
JetBrains plugin 0.4.0 JetBrains Marketplace
GitHub Action v1.13.0 Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.14.0        # or: npx oauthlint@0.14.0 scan .

Browse the rules at https://oauthlint.dev/rules/ · Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.13.0...oauthlint@0.14.0

Assets 2
Loading