HackerOne #4169051 — PoC start page

This page exists solely to let the triage team independently reproduce the OAuth flow described in report #4169051 against their own Notion test account/workspace. It performs no action on its own — clicking the link below simply opens Notion's genuine /authorize endpoint with our self-hosted CIMD client id. Nothing is read or written until you (the clicking user) complete the consent screen yourself.

CIMD document: /client-metadata.json
JWKS: /jwks.json

What to look for on the consent screen: it should show only the client name/logo and the redirect_uri — the actual client_id host (kdp-relay-9f2.duckdns.org) is never displayed anywhere.

Continue to Notion authorize