jwt

Client-Side Secret Exposure in Modern SPA/JAMstack Applications

How we found hardcoded signing keys and BaaS credentials in production JS bundles across two separate engagements, and how we triaged them.