Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#jwt×
Sort
2 posts ← reset filters
SecurityYour JWT Decoder Is Missing These Attacks (Even This Better One)
A new client-side JWT decoder catches subtle token flaws that jwt.io ignores. But securing JWTs is still a server-side problem. Here's the full picture from someone who's exploited these bugs in production.
Jun 14, 2026 · 13 min- API RE
What your JWT tokens reveal about your backend
JWTs are meant to be opaque to users. They're not. Here's what I learn about your architecture just by decoding one.
May 18, 2026 · 8 min