If you found security bugs, please do not send a public issue or patch. Report them through GitHub private vulnerability reporting.

Or, you can use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.

You may use AI tools to find or describe an issue. In all cases:

1. A human must check the finding before it is reported.
2. The report must include a proof of concept that uses the public Authlib API.
3. The report must explain what an attacker can do, and under which conditions.

Reports that do not follow these rules may be closed without reply.

Read the full security policy.