Google's OAuth review is complete. Here is what it covered.
Google completed its OAuth verification review for Klorn on 2026-10-03. Before that, Klorn was independently assessed against CASA Tier 2 by TAC Security; result: In Compliance. This note is the plain version: what was checked, what Klorn can do with your Google account as a result, and what none of this means.
What happened, in order
- 2026-08-12 — TAC Security evaluated Klorn: a CASA Tier 2 assessment using dynamic application security testing (DAST).
- 2026-08-30 — the report was issued. Result: In Compliance, at assurance level AL1 (OWASP ASVS Level 1).
- 2026-10-02 — the Letter of Validation was submitted to Google.
- 2026-10-03 — Google completed its OAuth verification review for Klorn.
Why it matters if your mail runs through Klorn
Klorn reads your mail so it can decide what deserves your attention. Until now, what it could ask Google for and how its security held up were things you had to take from us or from the source code. Two parts of that are now checked by someone else: a third party has assessed Klorn against CASA Tier 2, and the scopes Klorn uses are the ones Google approved in its review.
The five scopes, and what each one is for
gmail.readonly— read your messages so Klorn can sort them, show the reason for each decision, and summarize a thread when you ask.gmail.modify— change a message's state when you act in Klorn: archive, move to Trash, star, mark read, or save a reply draft into Gmail.gmail.send— send only what you approve, such as a reply you confirm or an unsubscribe you ask for, or an auto-reply under rules you set yourself.calendar.readonly— read free/busy across your calendars, so meeting emails are checked against your real schedule.calendar.events— add, change or remove an event on your primary calendar when you ask Klorn to.
The shape of the request is part of the point. Signing in with Google asks only for your name and email; the mail and calendar scopes come later, in a second consent screen, when you connect an inbox. A calendar-only link asks for calendar.readonly with no mail scope at all. Klorn does not request Gmail's full-access scope, and on Calendar it asks only for calendar.events and calendar.readonly, never the full Calendar scope. (openid and userinfo.email/userinfo.profile also appear in that file; they only identify which account signed in and were not part of the review.) The whole list lives in one file, packages/api/src/mail/gmail.ts, so any change to it would show up in a public diff.
What this does not mean
It is not an endorsement of Klorn by Google. The review and the assessment check how Klorn handles the Google data it requests; they do not cover anything beyond those scopes. The assessment is not a SOC 2 audit, and we are not claiming one.
It also does not add providers. Today you can connect Gmail, Google Calendar and Naver Mail. Other providers are not yet available.
What happens next
The assessment is repeated every year; the next one is due in August 2027. Work on additional providers continues, with no date to announce. The security page now carries the dates and scopes above next to the file that implements each security claim, so you can check them instead of trusting this post.
The code behind every claim here is AGPL: github.com/k08200/klorn.
Try Klorn free