JSON Web Token (JWT) Weaknesses
Overview
Detects insecure JWT implementations, such as accepting 'none' algorithms or using hardcoded secrets.
Remediation
Always enforce cryptographic signatures (e.g., HS256, RS256). Do not allow the 'none' algorithm. Always load secrets from environment variables.