> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit

<AccordionGroup>
  <Accordion title="jwt-decode-without-verify">
    Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-345: Insufficient Verification of Data Authenticity
    <br />**OWASP**: <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="jwt-exposed-data">
    The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-522: Insufficiently Protected Credentials
    <br />**OWASP**: <br />- A02:2017 - Broken Authentication
    <br />- A04:2021 - Insecure Design
  </Accordion>
</AccordionGroup>