I Audited 12 Open Source JWT Implementations and Found the Same 6 Mistakes

I spent last month reviewing JWT implementations across 12 open-source Node.js projects on GitHub — ranging from starter templates with 2k stars to production boilerplates used by teams at real companies. I found the same 6 mistakes in almost every one.

None of these projects are bad. The developers are skilled. The mistakes are subtle, copy-paste errors from tutorials that nobody questioned.

Here they are.

Mistake 1 — The Secret Is Literally "secret"

I found this in three separate projects:

I Audited 12 Open Source JWT Implementations and Found the Same 6 Mistakes

Related reading

🔐 7 JWT Authentication Mistakes I Keep Seeing in Production

4 Security Bugs I Found in My Own Auth System (And How I Fixed Them)

JWT Authentication Confused Me. Then I Built It From Scratch

Your JWT decoder might be leaking your tokens. Here's how to check.

Stop pasting JWTs into random websites

I Inherited a NestJS Codebase. The First Lint Run Found 6 Vulnerabilities.