[bonifaido]

Summary

• Encode generic RFC 8693 token requests as application/x-www-form-urlencoded by default.
• Add WithBodyFormat(BodyFormatJSON) for JSON-only endpoints and keep the OpenAI helper on JSON.
• Document the v0.7.0 migration behavior and add private vulnerability reporting instructions.

Compatibility

The default changes from JSON in v0.7.0. Callers using a JSON-only endpoint through GetCredentials must pass WithBodyFormat(BodyFormatJSON) when upgrading. The OpenAI helper selects JSON automatically.

Waterwheel remains pinned to tokenex v0.7.0 for now; its companion docs PR narrows the supported RFC 8693 claim until a tagged tokenex release is available.

Verification

• go test ./...
• go test -race -count=1 ./pkg/rfc8693

[Copilot]

🟡 Changes recommended

A moderate active finding remains because RFC 8693 telemetry omits the selected body format, preventing operators from distinguishing form and JSON request failures.

1 open issue

• Record body format in RFC 8693 span attributes · New

What changed in this PR

Updates RFC 8693 token exchanges to use application/x-www-form-urlencoded by default while retaining JSON support for JSON-only endpoints such as OpenAI. The PR also documents migration behavior and adds private vulnerability-reporting guidance.

Changes:

• Adds BodyFormat and WithBodyFormat, with form encoding as the default.
• Keeps the OpenAI helper on JSON.
• Expands tests for form encoding, JSON overrides, escaping, and OpenAI requests.
• Adds migration documentation and SECURITY.md reporting instructions.

File	Summary
SECURITY.md	Adds private vulnerability-reporting instructions.
README.md	Links contributors to the security policy.
pkg/​rfc8693/​rfc8693.go	Implements configurable form or JSON token request encoding. Moderate issue (2 votes): credential.fetch spans do not record cfg.body_format, making form-versus-JSON failures difficult to diagnose; add the attribute and telemetry coverage.
pkg/​rfc8693/​rfc8693_test.go	Tests form-default behavior, JSON encoding, escaped values, and OpenAI requests.
pkg/​rfc8693/​option.go	Adds the WithBodyFormat option.
pkg/​rfc8693/​openai.go	Forces JSON encoding for OpenAI workload identity requests.
docs/​rfc8693.md	Documents the new default, migration requirements, and OpenAI behavior.

_{Review effort: Lite}