Please report any security issue to https://www.sfdc.co/SubmitVuln as soon as it is discovered.
This repository publishes a protocol specification and small reference
implementations intended for illustration, not production use. The specification's
own security requirements are normative in spec.md §10 and elaborated in
docs/security.md. Consumers building on this profile should have
their security stakeholders review any reference code and its dependencies before use.