JWT

Finds jwt.encode() calls where the signing secret is a hardcoded string instead of a runtime configuration value.

Detects jwt.encode() calls using algorithm='none', which creates unsigned tokens that anyone can forge.

Detects jwt.decode() calls that may bypass signature verification, allowing tampered tokens to be accepted.

Detects jwt.encode() calls where passwords or secrets may be included in the token payload, exposing them to anyone who reads the token.

Traces user-controlled input from Flask/Django request parameters into jwt.encode() payloads using taint analysis.