Built by people who review auth code for a living.

OAuthLint began as a private ruleset, built from reviewing OAuth, OIDC, and JWT code and watching the same mistakes recur. Every rule traces back to a real bug caught in review, and lately to the same bugs showing up in AI-generated pull requests. It is open source, published under Auspeo, because the pattern is everywhere now.

Why curation beats coverage

A security tool that cries wolf gets turned off. We've all muted a scanner that flagged the same false positive on every PR. So the bar for OAuthLint is uncomfortable on purpose: a rule must fire on the real bug and stay completely silent on idiomatic, correct auth code. If it can't, it doesn't ship.

That discipline is why the pack stays deliberately small. Each rule is hand-written, hand-verified against a corpus of clean libraries and real vulnerable code, and mapped to a CWE so the finding is actionable, not just alarming.