theAuth
Star Quickstart

Security

Security practices, stated plainly

What the code does, how releases are signed, and how to report a vulnerability. Grounded in the SECURITY.md files and the Go threat model. No certifications are claimed.

Read SECURITY.md Go threat model

Security datasheet

DatasheetTypeScript core and Go module

Credentials

Agent tokens
kv_ prefix, 32 random bytes, shown once, only a SHA-256 hash stored.
Passwords, TypeScript
PBKDF2-SHA256 at 100,000 iterations (capped for Cloudflare Workers; the source notes OWASP recommends more on Node).
Passwords, Go
Argon2id with defaults of 64 MiB memory, 3 passes, 4 lanes. Unknown-email sign-in pays the same cost to avoid user enumeration.
Breach checking
Optional HaveIBeenPwned check using k-anonymity: only the first 5 characters of the SHA-1 hash leave your server. You call it where you accept passwords. HIBP docs.
Go signing keys
Ed25519 JWTs, JWKS rotation every 30 days, previous key kept for overlap.

Protocol

PKCE
S256 only. The plain method is not implemented.
Refresh tokens (Go)
Rotation with family revocation when an old token is replayed.
Audience binding
RFC 8707 resource binding on tokens (Go: mandatory).
CSRF (Go)
OAuth state in an HttpOnly cookie compared on callback. RequireState for /authorize is off by default and should be enabled in production.
Rate limiting
Per-IP defaults on sign-in, sign-up, magic link, OTP, TOTP and token endpoints in TypeScript, with an optional Redis store. Go has per-IP and per-email middleware. Rate limiting docs.

Supply chain

Go releases
Signed with cosign keyless (Sigstore), CycloneDX SBOM, and a SLSA provenance attestation. The repository README labels this SLSA level 3. Releases.
TypeScript dependencies
Three runtime dependencies: drizzle-orm, jose, zod, monitored with Dependabot.

Hashing differs between the TypeScript and Go libraries because of their runtimes. Pick the one that matches your deployment.

Vulnerability disclosure

Report privately, never in a public issue

The two repositories publish separate policies. Both prefer GitHub private vulnerability reporting.

  • TypeScript repoPrivate advisory (preferred), or email support@glincker.com with the subject [Security] theauth vulnerability.
  • 48 hoursAcknowledgment. Assessment within 5 business days, fix timeline within 10 business days.
  • 90 daysPublic disclosure after confirmation, coordinated with the reporter. If a fix cannot ship, we still disclose so users can mitigate.
  • Go repoPrivate advisory (preferred), or security@glincker.com. Acknowledgment in 48 hours for critical, high and moderate reports. Fix targets: 14 days critical or high, 30 days moderate. Read the full Go policy.

Full text: SECURITY.md. Out of scope includes denial of service, social engineering and upstream dependency issues.

What we do not claim

  • No certifications. There is no SOC 2, ISO 27001 or ISO 42001 certificate. Compliance material is mapping and evidence, not an attestation.
  • No third-party audit is published on this site.
  • The operator owns TLS, secrets and infrastructure. The Go threat model lists these as out of scope.
  • Defaults need tuning. Go's RequireState is off by default, and revocation propagates to Go resource servers within the introspection cache TTL (60 seconds by default).

Get started

Give your first agent an identity.

Install the package, create an agent with scoped permissions, and read its first audit record. The core runs on Postgres, SQLite, MySQL or D1, and the Go module needs a single go get.

Read the quickstart View on GitHub
  • npm install @glinr/theauth
  • go get github.com/glincker/theauth-go
Or skip hosting with theAuth Cloud