Subject: [OAUTH-WG] How to report a possible security threat

From: Rutger Hertogh <[email-masked]>
Date: Sat, 28 Aug 2021 15:56:51 +0200

Hi all,

How can I report a possible security threat?

Thanks,
Rutger

---

From: Benjamin Kaduk <[email-masked]>
Date: Sat, 28 Aug 2021 11:22:20 -0700

> How can I report a possible security threat?

The answer depends on whether it's believed to be an issue with the
protocol itself vs a specific implementation or implementations of it.

The IETF guidance on reporting protocol vunlerabilities (the former
category) is available at
https://www.ietf.org/standards/rfcs/vulnerabilities/

-Ben

---

From: Rutger Hertogh <[email-masked]>
Date: Sun, 29 Aug 2021 12:52:18 +0200

Hi Benjamin,

Thanks, on https://oauth.net/security/ they referred to this mailing list
but it doesn't seem smart to just blast it around in a public mailing list.
I'll follow the description from your link.

Thanks & Regards,
Rutger