OAuthLint 0.15.0

A reliability release: rules that were silently dropped now run. Four JS/TS rules failed to parse on the Opengrep engine the CLI, Action, and pre-commit actually use, so they were silently skipped on every scan, in every language. Fixed and validated on both engines, plus fewer false positives on test code and a tightened plaintext-password rule. All 271 rules now run.

Fixed

• Rules silently dropped on the shipped engine. Four JS/TS rules (NestJS guard-always-true; NextAuth redirect-open, session-token-leak, authorized-always-true) used a bare method-shorthand pattern that fails to parse on the Opengrep engine the CLI/Action/pre-commit run, silently dropping them on every scan, any language. Patterns are now wrapped in a parseable node and validated on both Opengrep 1.25 and semgrep 1.157.
• Fewer false positives on test code. Scans now skip test/spec/__tests__/__mocks__/story files by default (the advertised exclude/include config is now wired end-to-end). Opt back in with exclude: [].
• Plaintext-password rule tightened to cut a false positive on values hashed into a normally-named variable before persistence.

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.15.0	npm
oauthlint-rules	0.11.1	npm
oauthlint-mcp	0.2.7	npm
VS Code extension	0.10.0	Marketplace (auspeo.oauthlint-vscode) + Open VSX
JetBrains plugin	0.4.1	JetBrains Marketplace
GitHub Action	v1.13.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.15.0        # or: npx oauthlint@0.15.0 scan .

Browse the rules at https://oauthlint.dev/rules/ · Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.14.0...oauthlint@0.15.0

OAuthLint 0.14.0

OAuthLint now covers mobile: Swift/iOS and Android. The same low-false-positive linting, now for the auth mistakes AI assistants ship in mobile apps. 18 new rules for iOS (Swift, Vapor) and Android (Kotlin and the manifest/config XML), validated at zero false positives on AppAuth-iOS and AppAuth-Android. The pack is now 271 rules.

Added

• Swift / iOS (8 rules):
  • Tokens stored in UserDefaults / @AppStorage instead of the Keychain, and insecure Keychain accessibility (kSecAttrAccessibleAlways).
  • OAuth run in an in-app WKWebView (a phishing surface), and a non-ephemeral ASWebAuthenticationSession.
  • Hard-coded credentials, plus Vapor server checks: a hard-coded JWT HMAC key and wildcard CORS with credentials.
• Android (10 rules):
  • Kotlin: tokens in SharedPreferences instead of EncryptedSharedPreferences, OAuth in a WebView, cleartext (http://) auth endpoints, a trust-all onReceivedSslError, hard-coded secrets, and PKCE explicitly disabled in AppAuth.
  • Android XML: usesCleartextTraffic="true" in the manifest, hard-coded secrets in strings.xml, cleartext permitted in a network-security-config, and an exported activity claiming an OAuth redirect.
• Every mobile rule is a plain, low-false-positive pattern, scoped by the exact API and by key/URL names, and validated at zero false positives against the reference OAuth clients (AppAuth-iOS, AppAuth-Android).
• The VS Code extension and the pre-commit hook now scan Swift and Android XML too.

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.14.0	npm
oauthlint-rules	0.11.0	npm
oauthlint-mcp	0.2.6	npm
VS Code extension	0.10.0	Marketplace (auspeo.oauthlint-vscode) + Open VSX
JetBrains plugin	0.4.0	JetBrains Marketplace
GitHub Action	v1.13.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.14.0        # or: npx oauthlint@0.14.0 scan .

Browse the rules at https://oauthlint.dev/rules/ · Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.13.0...oauthlint@0.14.0

OAuthLint 0.13.0

OAuthLint now covers PHP, Ruby and Kotlin. The same low-false-positive OAuth, OIDC, JWT and MCP linting, now across ten languages. 61 new rules, including framework packs for ASP.NET Core, Gin, Hono, FastAPI and Ktor, validated at zero false positives on real auth libraries. The pack is now 253 rules across ten languages.

Added

• Three new languages:
  • PHP (Laravel, Socialite, firebase/php-jwt, lcobucci/jwt): manual JWT decode without verification, hard-coded signing keys, Socialite stateless() CSRF, insecure cookie flags, unsecured signers, insecure session config.
  • Ruby (Rails, Devise, OmniAuth, Doorkeeper, rack-cors): verification off, missing algorithm allow-list, none algorithm, hard-coded secrets, CSRF skips, OmniAuth GET and ignored-state, Doorkeeper misconfig, insecure session store.
  • Kotlin (Ktor, java-jwt, nimbus-jose-jwt): Algorithm.none(), hard-coded HMAC secret, decode without verify, missing issuer/audience binding, insecure Ktor sessions, wildcard CORS with credentials.
• New framework packs: ASP.NET Core (C#), Gin / Echo / Fiber (Go), Hono and better-auth (TypeScript), FastAPI (Python).
• MCP server-auth: DNS-rebinding protection left off by default, and predictable session ids, for the official TypeScript and Python SDKs. A new Scanning MCP servers docs page walks the whole pack.
• Cross-language consistency: hard-coded OAuth client-secret checks and weak-crypto checks (insecure random, weak password hashing, ECB mode) filled in across C#, Python, Java, Rust and Go.
• The VS Code extension now gives inline diagnostics for all ten languages, not just JavaScript and TypeScript, and the pre-commit hook scans them too.
• Tuned to stay quiet on real auth libraries: validated at zero false positives on firebase/php-jwt, ruby-jwt, OmniAuth, golang/oauth2 and more.

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.13.0	npm
oauthlint-rules	0.10.0	npm
oauthlint-mcp	0.2.5	npm
VS Code extension	0.9.0	Marketplace (auspeo.oauthlint-vscode) + Open VSX
JetBrains plugin	0.3.0	JetBrains Marketplace
GitHub Action	v1.12.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.13.0        # or: npx oauthlint@0.13.0 scan .

Browse the rules at https://oauthlint.dev/rules/ · Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.12.0...oauthlint@0.13.0

oauthlint-rules@0.11.1

Ruleset only.

Fixes

• Four JS/TS rules (NestJS guard-always-true; NextAuth redirect-open, session-token-leak, authorized-always-true) failed to parse on Opengrep 1.25 (bare method-shorthand patterns), silently dropping on every scan. Now wrapped in a parseable node; validated on Opengrep 1.25 and semgrep 1.157.
• flow/password-plaintext tightened to require a raw password reference, cutting a false positive.

OAuthLint 0.12.0

OAuthLint now lints MCP servers. The same low-false-positive OAuth, OIDC and JWT linting, now covering the OAuth 2.1 mistakes AI tools ship in Model Context Protocol servers. 8 new rules for the official TypeScript and Python MCP SDKs, validated at zero false positives on the SDK source, plus a new oauthlint probe command. The pack is now 192 rules across 6 languages.

Added

• MCP server-auth rule pack: 8 new rules for the OAuth 2.1 mistakes MCP servers commonly ship, for the official TypeScript (@modelcontextprotocol/sdk) and Python (mcp / FastMCP) SDKs:
  • Token pass-through: the caller's token forwarded to an upstream API instead of a token exchange (confused deputy)
  • Missing RFC 8707 audience binding and RFC 9728 Protected Resource Metadata
  • MCP transports exposed over the network with no authentication
  • Server-side request forgery from tool-handler arguments
  • Validated at zero false positives on the official SDK source, taint-mode where it matters. (#136)
• oauthlint probe <url>: a live, credential-free OAuth 2.1 conformance check for a running MCP server (does it require a token, advertise RFC 9728 metadata, and reject invalid tokens).

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.12.0	npm
oauthlint-rules	0.9.0	npm
oauthlint-mcp	0.2.4	npm
VS Code extension	0.8.0	Marketplace (auspeo.oauthlint-vscode) + Open VSX
JetBrains plugin	0.2.0	JetBrains Marketplace
GitHub Action	v1.11.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.12.0        # or: npx oauthlint@0.12.0 scan .

Browse the rules at https://oauthlint.dev/rules/ · Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.11.0...oauthlint@0.12.0

OAuthLint 0.11.0

OAuthLint now covers C# and ASP.NET Core. The same low-false-positive OAuth, OIDC and JWT linting, now for .NET. 12 new rules, validated at zero false positives on real .NET auth libraries. The pack is now 184 rules across 6 languages.

Added

• C# / ASP.NET Core support: 12 new rules for the auth mistakes AI tools commonly ship in .NET services:
  • JWT bearer validation turned off (signature, audience, lifetime or issuer)
  • Hard-coded signing keys and OAuth client secrets
  • Insecure transport (HTTPS metadata off, PKCE disabled)
  • Insecure auth cookies and over-permissive CORS
  • TLS certificate validation disabled
• Tuned to flag your app's configuration, not the frameworks it uses, so it stays quiet on OIDC servers like OpenIddict and IdentityServer. (#134)

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.11.0	npm
oauthlint-rules	0.8.0	npm
oauthlint-mcp	0.2.3	npm
VS Code extension	0.7.0	Marketplace (auspeo.oauthlint-vscode)
GitHub Action	v1.10.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.11.0        # or: npx oauthlint@0.11.0 scan .

Browse the rules at https://oauthlint.dev/rules/ · Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.10.2...oauthlint@0.11.0

OAuthLint 0.10.2

Fixes a silent scan failure in minimal environments. In CI containers or shells without a UTF-8 locale, a scan could report "no issues" instead of actually running. It now runs correctly everywhere.

Fixed

• Scans no longer come back empty in environments without a UTF-8 locale (CI containers, minimal shells). (#123)

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.10.2	npm
oauthlint-mcp	0.2.2	npm

Upgrade

npm i -g oauthlint@0.10.2

Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.10.1...oauthlint@0.10.2

OAuthLint 0.10.1

Adds NestJS and Fastify support. New framework-aware auth rules for two of the most common Node.js API frameworks.

Added

• NestJS and Fastify rule packs: hard-coded JWT secrets, always-true auth guards, and over-permissive CORS. (#120)

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.10.1	npm
oauthlint-rules	0.7.0	npm
oauthlint-mcp	0.2.1	npm
GitHub Action	v1.9.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.10.1

Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.10.0...oauthlint@0.10.1

OAuthLint 0.9.2

Adds Auth.js/NextAuth and Express support. Framework-aware auth rules for two of the most common Node.js stacks.

Added

• Auth.js / NextAuth and Express rule packs.

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.9.2	npm
oauthlint-rules	0.6.0	npm
oauthlint-mcp	0.1.3	npm
GitHub Action	v1.7.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.9.2

Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.9.1...oauthlint@0.9.2

OAuthLint 0.10.0

The scanner is now self-contained. No Semgrep to install: the CLI downloads and checksum-verifies its own pinned engine on first run, then caches it.

Changed

• The CLI and MCP server bundle the rule pack and manage their own engine, so there is nothing else to install.

Ships in this release

Component	Version	Where
oauthlint (CLI)	0.10.0	npm
oauthlint-mcp	0.2.0	npm
VS Code extension	0.6.0 / 0.6.1	Marketplace
GitHub Action	v1.8.0	Auspeo/oauthlint@v1

Upgrade

npm i -g oauthlint@0.10.0

Full changelog: https://github.com/Auspeo/oauthlint/compare/oauthlint@0.9.2...oauthlint@0.10.0