AgentGate is a learning project, not production software. Don't use it to protect real accounts or data.

It implements the OAuth protocol logic by hand to learn how it works, but uses vetted libraries for signing and verifying tokens rather than custom cryptography.

If you find a security issue, please open a GitHub issue. There are no real users or secrets, so public disclosure is fine.