Checks · AUTH-006

AUTH-006 · JWT verified without algorithm, issuer or audience

Why it matters

A loose JWT check can accept a token signed with a different algorithm or issued for another app.

How we detect it

Verify calls omit algorithm, issuer or audience.

How we fix it

Pin the algorithm and check issuer and audience.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles