CheckVibeCodeCheckVibeCode
Checks/Vulnerability
VulnerabilityHeuristic5 checks

JWT Security Audit

Analyze JSON Web Tokens for weak algorithms, key exposure, and implementation flaws.

Run this scanSee pricing

How this scan works

  • Accept a token via param, or use one surfaced by the API Key Exposure or Browser Storage scanners
  • Decode header and payload — no signature verification, read-only
  • Flag alg: none and alg: HS256 (symmetric-key confusion risk) as configurations worth reviewing
  • Flag a missing exp claim or an excessively long lifetime
  • Flag sensitive-looking claims (email, role, is_admin) stored client-readable

More checks in Vulnerability

SQL Injection ScannerCross-Site Scripting (XSS) ScannerAPI Key Exposure ScannerCORS Misconfiguration ScannerCSRF Protection ScannerAuthentication Flow Scanner