We take the security of Janua seriously. As an OAuth 2.0 / OIDC authentication provider, security is our top priority.

Please DO NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via email to: security@madfam.io

Include the following information:

• Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
• Full paths of source file(s) related to the issue
• Location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution Target: Within 30 days for critical issues

1. Acknowledgment: We'll confirm receipt of your report
2. Assessment: Our security team will assess the vulnerability
3. Communication: We'll keep you informed of our progress
4. Resolution: We'll work on a fix and coordinate disclosure
5. Credit: With your permission, we'll credit you in the release notes

• Store tokens securely (use httpOnly cookies where possible)
• Implement token rotation
• Use short-lived access tokens with refresh tokens

• Always validate iss (issuer) claims
• Verify aud (audience) claims match your client ID
• Check token expiration (exp claim)

• Always use HTTPS in production
• Configure proper CORS policies
• Enable rate limiting on authentication endpoints
• Use secure session storage (Redis with TLS)

Janua includes the following security features:

• PKCE support for public clients
• Token binding
• Refresh token rotation
• Session management and revocation
• Brute force protection
• Audit logging

Janua is designed to help you meet:

• OAuth 2.0 Security Best Current Practice (RFC 6819)
• OpenID Connect Core 1.0
• OWASP Authentication Guidelines