Will It Vibe?JWT expiration check disabled
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A JWT verify call sets ignoreExpiration: true, so expired tokens keep working and revocation-by-expiry no longer holds.
Why it matters
ignoreExpiration: true tells the verifier to accept tokens past their exp time. Short token lifetimes are a primary way to limit the damage of a leaked token, so ignoring expiration means a token stolen months ago still works today. It also breaks any logout or revocation scheme that relies on tokens aging out.
How to fix it
Remove ignoreExpiration: true so expired tokens are rejected. If some clock skew tolerance is genuinely needed, use the library clockTolerance option with a small window (a few seconds) instead of ignoring expiry entirely. Keep access-token lifetimes short and use refresh tokens for longer sessions.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo