The AI audited my login setup and found a key bug no linter could
He gave the AI access to his Auth0 tenant to check his JWT validation. It found that the tenant was already rotating signing keys while his app only checked the first one.
How it works
- Gives the AI access to his Auth0 tenant
- The AI audits the JWT validation
- Finds the tenant rotates signing keys but the app only checks the first one
Why it’s worth knowing
The bug was not in his code alone. His tenant had moved on to rotating keys and his app had not kept up, and the AI spotted the mismatch.
Where it’s from
Summarized from a public post on bsky.app. See the original ↗