eslint-plugin-jwt-security 2.3.0 → 2.3.1

package/{dist/src → src}/rules/no-timestamp-manipulation/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noTimestampManipulation = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -80,7 +75,6 @@ exports.noTimestampManipulation = (0, eslint_devkit_1.createRule)({
                 if (!optionsArg) {
                     return;
                 }
-                // Check for noTimestamp: true
                 if ((0, utils_1.hasOption)(optionsArg, 'noTimestamp')) {
                     const value = (0, utils_1.getOptionValue)(optionsArg, 'noTimestamp');
                     if (value?.type === 'Literal' && value.value === true) {

package/{dist/src → src}/rules/no-weak-secret/index.js

@@ -1,14 +1,8 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noWeakSecret = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const utils_1 = require("../../utils");
-// Common weak secret patterns
 const WEAK_SECRET_PATTERNS = [
     /^secret$/i,
     /^password$/i,
@@ -99,25 +93,16 @@ exports.noWeakSecret = (0, eslint_devkit_1.createRule)({
     create(context) {
         const options = context.options[0] ?? {};
         const { minSecretLength = 32 } = options;
-        /**
-         * Check if a value matches known weak patterns
-         */
         const isKnownWeakPattern = (value) => {
             return WEAK_SECRET_PATTERNS.some((pattern) => pattern.test(value));
         };
-        /**
-         * Check the secret argument for weakness
-         */
         const checkSecret = (secretNode) => {
-            // Environment variables are considered safe (configuration)
             if ((0, utils_1.isEnvVariable)(secretNode)) {
                 return;
             }
-            // Check string literals
             if (secretNode.type === 'Literal' &&
                 typeof secretNode.value === 'string') {
                 const secretValue = secretNode.value;
-                // Check for known weak patterns
                 if (isKnownWeakPattern(secretValue)) {
                     context.report({
                         node: secretNode,
@@ -125,7 +110,6 @@ exports.noWeakSecret = (0, eslint_devkit_1.createRule)({
                     });
                     return;
                 }
-                // Check for short secrets
                 if (secretValue.length < minSecretLength) {
                     context.report({
                         node: secretNode,
@@ -137,7 +121,6 @@ exports.noWeakSecret = (0, eslint_devkit_1.createRule)({
                     });
                 }
             }
-            // Template literals with obvious weak values
             if (secretNode.type === 'TemplateLiteral' && secretNode.quasis.length === 1) {
                 const rawValue = secretNode.quasis[0].value.raw;
                 if (isKnownWeakPattern(rawValue) || rawValue.length < minSecretLength) {
@@ -150,11 +133,9 @@ exports.noWeakSecret = (0, eslint_devkit_1.createRule)({
         };
         return {
             CallExpression(node) {
-                // Check both sign and verify operations
                 if (!(0, utils_1.isSignOperation)(node) && !(0, utils_1.isVerifyOperation)(node)) {
                     return;
                 }
-                // Secret is usually the second argument
                 if (node.arguments.length >= 2) {
                     checkSecret(node.arguments[1]);
                 }

package/{dist/src → src}/rules/require-algorithm-whitelist/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireAlgorithmWhitelist = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -79,16 +74,13 @@ exports.requireAlgorithmWhitelist = (0, eslint_devkit_1.createRule)({
     create(context) {
         return {
             CallExpression(node) {
-                // Only check verify operations
                 if (!(0, utils_1.isVerifyOperation)(node)) {
                     return;
                 }
-                // Need at least token and key arguments
                 if (node.arguments.length < 2) {
                     return;
                 }
                 const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // No options at all - definitely missing algorithms
                 if (!optionsArg) {
                     context.report({
                         node,
@@ -96,7 +88,6 @@ exports.requireAlgorithmWhitelist = (0, eslint_devkit_1.createRule)({
                     });
                     return;
                 }
-                // Options exist but no algorithms property
                 const hasAlgorithms = (0, utils_1.hasOption)(optionsArg, 'algorithms') ||
                     (0, utils_1.hasOption)(optionsArg, 'algorithm') ||
                     (0, utils_1.hasOption)(optionsArg, 'alg');

package/{dist/src → src}/rules/require-audience-validation/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireAudienceValidation = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -78,7 +73,6 @@ exports.requireAudienceValidation = (0, eslint_devkit_1.createRule)({
                     return;
                 }
                 const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // No options at all
                 if (!optionsArg) {
                     context.report({
                         node,
@@ -86,7 +80,6 @@ exports.requireAudienceValidation = (0, eslint_devkit_1.createRule)({
                     });
                     return;
                 }
-                // Check for audience option
                 if (!(0, utils_1.hasOption)(optionsArg, 'audience') && !(0, utils_1.hasOption)(optionsArg, 'aud')) {
                     context.report({
                         node: optionsArg,

package/{dist/src → src}/rules/require-expiration/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireExpiration = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -75,10 +70,6 @@ exports.requireExpiration = (0, eslint_devkit_1.createRule)({
         },
     ],
     create(context) {
-        /**
-         * Check if payload contains exp claim
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const payloadHasExp = (payloadNode) => {
             if (payloadNode.type !== 'ObjectExpression') {
                 return false;
@@ -89,25 +80,20 @@ exports.requireExpiration = (0, eslint_devkit_1.createRule)({
         };
         return {
             CallExpression(node) {
-                // Only check sign operations
                 if (!(0, utils_1.isSignOperation)(node)) {
                     return;
                 }
-                // Need at least payload argument
                 if (node.arguments.length < 1) {
                     return;
                 }
                 const payloadArg = node.arguments[0];
                 const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // Check if payload has exp claim
                 if (payloadHasExp(payloadArg)) {
                     return;
                 }
-                // Check if options has expiresIn
                 if (optionsArg && (0, utils_1.hasOption)(optionsArg, 'expiresIn')) {
                     return;
                 }
-                // Report missing expiration — suggest adding expiresIn to the options object
                 const optionsArg3 = node.arguments[2];
                 context.report({
                     node,
@@ -118,11 +104,9 @@ exports.requireExpiration = (0, eslint_devkit_1.createRule)({
                             fix(fixer) {
                                 const sourceCode = context.sourceCode;
                                 if (optionsArg3 && optionsArg3.type === eslint_devkit_1.AST_NODE_TYPES.ObjectExpression) {
-                                    // Options object exists but lacks expiresIn — insert property
                                     const openBrace = sourceCode.getFirstToken(optionsArg3);
                                     return fixer.insertTextAfter(openBrace, ' expiresIn: \'1h\',');
                                 }
-                                // No options arg — insert { expiresIn: '1h' } as third argument
                                 const lastArg = node.arguments[node.arguments.length - 1];
                                 return fixer.insertTextAfter(lastArg, ', { expiresIn: \'1h\' }');
                             },

package/{dist/src → src}/rules/require-issued-at/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireIssuedAt = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -62,10 +57,6 @@ exports.requireIssuedAt = (0, eslint_devkit_1.createRule)({
         },
     ],
     create(context) {
-        /**
-         * Check if payload contains iat claim
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const payloadHasIat = (payloadNode) => {
             if (payloadNode.type !== 'ObjectExpression') {
                 return false;
@@ -76,36 +67,24 @@ exports.requireIssuedAt = (0, eslint_devkit_1.createRule)({
         };
         return {
             CallExpression(node) {
-                // Only check sign operations
                 if (!(0, utils_1.isSignOperation)(node)) {
                     return;
                 }
-                // Need at least payload argument
                 if (node.arguments.length < 1) {
                     return;
                 }
                 const payloadArg = node.arguments[0];
                 const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // Check if payload has iat claim
                 if (payloadHasIat(payloadArg)) {
                     return;
                 }
-                // Check if options has noTimestamp: false (meaning iat IS added)
-                // jsonwebtoken adds iat by default unless noTimestamp: true
                 if (optionsArg && (0, utils_1.hasOption)(optionsArg, 'noTimestamp')) {
-                    // If noTimestamp is explicitly set, we flag it (they're disabling iat)
                     context.report({
                         node: optionsArg,
                         messageId: 'missingIssuedAt',
                     });
                     return;
                 }
-                // For explicit payload objects without iat we intentionally do not
-                // report — jsonwebtoken adds iat by default. (A dead empty `if` that
-                // re-checked !payloadHasIat(payloadArg) — always true after the early
-                // return above — was removed as unreachable-by-construction.)
-                // Note: jsonwebtoken adds iat by default, so we don't flag by default
-                // This rule primarily catches explicit noTimestamp: true usage
             },
         };
     },

package/{dist/src → src}/rules/require-issuer-validation/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireIssuerValidation = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -78,7 +73,6 @@ exports.requireIssuerValidation = (0, eslint_devkit_1.createRule)({
                     return;
                 }
                 const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // No options at all
                 if (!optionsArg) {
                     context.report({
                         node,
@@ -86,7 +80,6 @@ exports.requireIssuerValidation = (0, eslint_devkit_1.createRule)({
                     });
                     return;
                 }
-                // Check for issuer option
                 if (!(0, utils_1.hasOption)(optionsArg, 'issuer') && !(0, utils_1.hasOption)(optionsArg, 'iss')) {
                     context.report({
                         node: optionsArg,

package/{dist/src → src}/rules/require-max-age/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireMaxAge = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -71,7 +66,6 @@ exports.requireMaxAge = (0, eslint_devkit_1.createRule)({
                     return;
                 }
                 const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // No options at all
                 if (!optionsArg) {
                     context.report({
                         node,
@@ -79,7 +73,6 @@ exports.requireMaxAge = (0, eslint_devkit_1.createRule)({
                     });
                     return;
                 }
-                // Check for maxAge option
                 if (!(0, utils_1.hasOption)(optionsArg, 'maxAge') && !(0, utils_1.hasOption)(optionsArg, 'clockTolerance')) {
                     context.report({
                         node: optionsArg,

package/src/types/index.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/{dist/src → src}/utils/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JWT_METHODS = exports.SENSITIVE_PAYLOAD_FIELDS = exports.SECURE_ALGORITHMS = exports.SYMMETRIC_ALGORITHMS = exports.INSECURE_ALGORITHMS = exports.JWT_LIBRARIES = void 0;
 exports.isJwtLibraryCall = isJwtLibraryCall;
@@ -18,9 +13,6 @@ exports.isVerifyOperation = isVerifyOperation;
 exports.isDecodeOperation = isDecodeOperation;
 exports.getOptionsArgument = getOptionsArgument;
 exports.isTestFile = isTestFile;
-/**
- * Supported JWT libraries
- */
 exports.JWT_LIBRARIES = {
     JSONWEBTOKEN: 'jsonwebtoken',
     JOSE: 'jose',
@@ -29,24 +21,15 @@ exports.JWT_LIBRARIES = {
     JWKS_RSA: 'jwks-rsa',
     JWT_DECODE: 'jwt-decode',
 };
-/**
- * Insecure algorithms that should be flagged
- */
 exports.INSECURE_ALGORITHMS = new Set([
     'none',
     'None',
     'NONE',
-    'HS256', // Only insecure when used with public keys
+    'HS256',
     'HS384',
     'HS512',
 ]);
-/**
- * Algorithms vulnerable to confusion attacks when used with asymmetric keys
- */
 exports.SYMMETRIC_ALGORITHMS = new Set(['HS256', 'HS384', 'HS512']);
-/**
- * Recommended secure algorithms
- */
 exports.SECURE_ALGORITHMS = new Set([
     'RS256',
     'RS384',
@@ -59,30 +42,20 @@ exports.SECURE_ALGORITHMS = new Set([
     'PS512',
     'EdDSA',
 ]);
-/**
- * Sensitive field names that should not be in JWT payload
- * All lowercase for case-insensitive matching
- */
 exports.SENSITIVE_PAYLOAD_FIELDS = new Set([
-    // Passwords
     'password', 'passwd', 'pwd', 'pass', 'secret',
-    // API Keys
     'apikey', 'api_key', 'api-key',
     'apisecret', 'api_secret', 'api-secret',
-    // Tokens
     'accesstoken', 'access_token', 'access-token',
     'refreshtoken', 'refresh_token', 'refresh-token',
     'bearertoken', 'bearer_token', 'bearer-token',
-    // Keys
     'privatekey', 'private_key', 'private-key',
     'secretkey', 'secret_key', 'secret-key',
-    // PII - Personal Identifiable Information
     'email', 'emailaddress', 'email_address', 'email-address',
     'phone', 'phonenumber', 'phone_number', 'phone-number',
     'ssn', 'socialsecuritynumber', 'social_security_number',
     'dob', 'dateofbirth', 'date_of_birth', 'birthdate',
     'address', 'streetaddress', 'street_address',
-    // Financial
     'creditcard', 'credit_card', 'credit-card',
     'cardnumber', 'card_number', 'card-number',
     'cvv', 'cvc', 'securitycode', 'security_code',
@@ -91,43 +64,29 @@ exports.SENSITIVE_PAYLOAD_FIELDS = new Set([
     'accountnumber', 'account_number', 'account-number',
     'routingnumber', 'routing_number', 'routing-number',
 ]);
-/**
- * JWT method patterns for different operations
- */
 exports.JWT_METHODS = {
     SIGN: new Set(['sign', 'signJWT', 'SignJWT']),
     VERIFY: new Set(['verify', 'verifyJWT', 'jwtVerify']),
     DECODE: new Set(['decode', 'jwtDecode', 'decodeJWT']),
 };
-/**
- * Check if a node represents a call to a JWT library method
- */
 function isJwtLibraryCall(node, targetMethods) {
-    // Check member expression: jwt.verify(), jose.jwtVerify()
     if (node.callee.type === 'MemberExpression') {
         const property = node.callee.property;
         if (property.type === 'Identifier') {
             return targetMethods.has(property.name);
         }
     }
-    // Check direct calls: jwtVerify(), jwtDecode()
     if (node.callee.type === 'Identifier') {
         return targetMethods.has(node.callee.name);
     }
     return false;
 }
-/**
- * Check if a node is a string literal with a specific value
- */
 function isStringLiteral(node, value) {
     if (node.type !== 'Literal' || typeof node.value !== 'string') {
         return false;
     }
     return value === undefined || node.value === value;
 }
-/**
- * Extract algorithm from options object
- */
 function extractAlgorithms(optionsNode) {
     const algorithms = [];
     for (const prop of optionsNode.properties) {
@@ -138,11 +97,9 @@ function extractAlgorithms(optionsNode) {
         if (keyName !== 'algorithms' && keyName !== 'algorithm' && keyName !== 'alg') {
             continue;
         }
-        // Single algorithm: { algorithm: 'HS256' }
         if (prop.value.type === 'Literal' && typeof prop.value.value === 'string') {
             algorithms.push(prop.value.value);
         }
-        // Array of algorithms: { algorithms: ['RS256', 'ES256'] }
         if (prop.value.type === 'ArrayExpression') {
             for (const elem of prop.value.elements) {
                 if (elem && elem.type === 'Literal' && typeof elem.value === 'string') {
@@ -153,17 +110,11 @@ function extractAlgorithms(optionsNode) {
     }
     return algorithms;
 }
-/**
- * Check if options object has a specific property set
- */
 function hasOption(optionsNode, optionName) {
     return optionsNode.properties.some((prop) => prop.type === 'Property' &&
         prop.key.type === 'Identifier' &&
         prop.key.name === optionName);
 }
-/**
- * Get the value of a specific option from options object
- */
 function getOptionValue(optionsNode, optionName) {
     for (const prop of optionsNode.properties) {
         if (prop.type === 'Property' &&
@@ -174,20 +125,13 @@ function getOptionValue(optionsNode, optionName) {
     }
     return undefined;
 }
-/**
- * Check if a literal appears to be a weak secret (short string)
- */
 function isWeakSecret(node, minLength = 32) {
     if (node.type === 'Literal' && typeof node.value === 'string') {
         return node.value.length < minLength;
     }
     return false;
 }
-/**
- * Check if a node is an environment variable access (safe pattern)
- */
 function isEnvVariable(node) {
-    // process.env.JWT_SECRET
     if (node.type === 'MemberExpression' &&
         node.object.type === 'MemberExpression' &&
         node.object.object.type === 'Identifier' &&
@@ -198,29 +142,15 @@ function isEnvVariable(node) {
     }
     return false;
 }
-/**
- * Check if this call looks like a JWT sign operation
- */
 function isSignOperation(node) {
     return isJwtLibraryCall(node, exports.JWT_METHODS.SIGN);
 }
-/**
- * Check if this call looks like a JWT verify operation
- */
 function isVerifyOperation(node) {
     return isJwtLibraryCall(node, exports.JWT_METHODS.VERIFY);
 }
-/**
- * Check if this call looks like a JWT decode operation (no verification)
- */
 function isDecodeOperation(node) {
     return isJwtLibraryCall(node, exports.JWT_METHODS.DECODE);
 }
-/**
- * Get the options argument from a JWT call
- * For jwt.verify(token, secret, options) -> returns options
- * For jwt.sign(payload, secret, options) -> returns options
- */
 function getOptionsArgument(node, optionsIndex = 2) {
     const arg = node.arguments[optionsIndex];
     if (arg && arg.type === 'ObjectExpression') {
@@ -228,9 +158,6 @@ function getOptionsArgument(node, optionsIndex = 2) {
     }
     return undefined;
 }
-/**
- * Check if file is a test file
- */
 function isTestFile(filename) {
     return /\.(test|spec)\.[jt]sx?$/.test(filename) ||
         /__(tests?|mocks?)__/.test(filename) ||

package/AGENTS.md

@@ -1,102 +0,0 @@
-# AGENTS.md
-
-> Context for AI coding agents working on eslint-plugin-jwt-security
-
-## Setup Commands
-
-```bash
-# Install dependencies (from monorepo root)
-npm install
-
-# Build this package
-nx build eslint-plugin-jwt-security
-
-# Run tests
-nx test eslint-plugin-jwt-security
-
-# Run tests with coverage
-nx test eslint-plugin-jwt-security --coverage
-
-# Lint this package
-nx lint eslint-plugin-jwt-security
-```
-
-## Code Style
-
-- TypeScript strict mode with `@interlace/eslint-devkit` types
-- Use `AST_NODE_TYPES` constants, never string literals for node types
-- Use `formatLLMMessage()` for all rule error messages
-- Include CWE, CVSS, OWASP in every security message
-- Use `c8 ignore` comments with documented reasons for untestable code
-- Single-pass AST traversal patterns (O(n) complexity)
-
-## Testing Instructions
-
-- Tests use `@typescript-eslint/rule-tester` with Vitest
-- Each rule has `index.ts` (implementation) and `*.test.ts` (tests) in same directory
-- Run specific rule test: `nx test eslint-plugin-jwt-security --testPathPattern="no-algorithm-none"`
-- Coverage target: ≥90% lines, ≥95% functions
-- All tests must pass before committing
-
-## Project Structure
-
-```
-src/
-├── index.ts          # Plugin entry, exports rules and configs
-└── rules/            # 13 rule directories
-    └── [rule-name]/
-        ├── index.ts       # Rule implementation
-        └── *.test.ts      # Rule tests
-docs/rules/           # Markdown documentation per rule
-```
-
-## Plugin Purpose
-
-Comprehensive JWT security ESLint plugin with **13 rules** covering algorithm attacks, replay prevention, and claim validation. Targets 6 major Node.js JWT libraries.
-
-## Rule Categories
-
-| Category               | Rules                                                                                                                                            | CWEs               |
-| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------ |
-| Algorithm Attacks      | `no-algorithm-none`, `no-algorithm-confusion`                                                                                                    | 347                |
-| Verification & Secrets | `require-algorithm-whitelist`, `no-decode-without-verify`, `no-weak-secret`, `no-hardcoded-secret`, `no-timestamp-manipulation`                  | 326, 345, 757, 798 |
-| Claims                 | `require-expiration`, `require-issued-at`, `require-issuer-validation`, `require-audience-validation`, `require-max-age`, `no-sensitive-payload` | 287, 294, 359, 613 |
-
-## Library Detection
-
-The plugin detects these method calls:
-
-- **Sign**: `jwt.sign()`, `signJWT()`, `SignJWT()`
-- **Verify**: `jwt.verify()`, `jwtVerify()`, `verifyJWT()`
-- **Decode**: `jwt.decode()`, `jwtDecode()`, `decodeJWT()`
-
-## Common Fix Patterns
-
-```typescript
-// Algorithm None Attack (CVE-2022-23540)
-// BAD: jwt.verify(token, secret, { algorithms: ['none'] })
-// GOOD: jwt.verify(token, secret, { algorithms: ['RS256'] })
-
-// Algorithm Confusion
-// BAD: jwt.verify(token, publicKey, { algorithms: ['HS256'] })
-// GOOD: jwt.verify(token, publicKey, { algorithms: ['RS256'] })
-
-// Hardcoded Secret
-// BAD: jwt.sign(payload, 'my-secret-key')
-// GOOD: jwt.sign(payload, process.env.JWT_SECRET)
-
-// Missing Expiration
-// BAD: jwt.sign({ sub: 'user' }, secret)
-// GOOD: jwt.sign({ sub: 'user' }, secret, { expiresIn: '1h' })
-
-// Replay Attack Prevention
-// BAD: jwt.sign(payload, secret, { noTimestamp: true })
-// GOOD: jwt.sign(payload, secret)
-// GOOD: jwt.verify(token, secret, { maxAge: '1h' })
-```
-
-## Security Considerations
-
-- CWE coverage: 287, 294, 326, 345, 347, 359, 613, 757, 798
-- Detects CVE-2022-23540 (Algorithm None attack)
-- Covers 6 major JWT libraries: jsonwebtoken, jose, jwt-decode, node-jose, jwt-simple, jsonwebtoken-esm