Engineering, plainly told.

Attack classes, CVE deep-dives, IdP integrations, framework recipes. Every article ends with the same problem solved by one HTTP call.

MAY 02, 2026

CI regression

Three JWT bugs that ship to prod silently — and the 5-line CI test that catches them

Three concrete failure modes that take down OIDC in production: JWKS rotation without overlap, wrong audience claims, and issuer config drift. Reproduction code, the one HTTP call that catches each, and the 5-line GitHub Actions step that runs the whole regression suite.

8 min read

APR 27, 2026

Attack class

The alg=none JWT vulnerability, with code that exploits it and a 5-line fix

Why the alg=none JWT bug class refuses to die, with working exploit code, the right way to refuse it, and the one HTTP call that catches every variant.

7 min read

APR 27, 2026

IdP integration

Validating Auth0 JWTs in production: the 8 checks Auth0's docs don't tell you

Auth0's quickstart shows signature verification. Real production needs eight checks. Here is each one, why it exists, and the failure mode it prevents.

9 min read

APR 27, 2026

Framework

Express JWT middleware in 2026: why express-jwt still has footguns and what to wire instead

express-jwt's defaults still let alg=none through on some configurations. Here is the safe handcrafted middleware in 60 lines, and the one-line replacement that off-loads verification to a service.

8 min read

More articles ship weekly. Watch the changelog for updates.