Sun’s gon shine on everything you do…

This is a really interesting bug, yet kinda simple. I bet researchers who read about it wish they had discovered it first, especially because it was sitting there in plain sight. I guess most people would have assumed, “It’s Google. Hundreds of researchers have probably tested this already.” Every now and then, we see critical vulnerabilities being reported to tech giants like Google, Meta, Amazon, and OpenAI, despite these companies having sophisticated security teams, vendors, and thousands of independent security researchers constantly hunting for vulnerabilities that their in-house teams, multimillion-dollar security tools, and vendors may have missed. Again, this is for you startup founders, heads of security, and engineering leaders whose platforms are already processing thousands or millions of dollars in transactions, or handling other critical operations. Don’t overestimate the security of your applications or infrastructure simply because you believe you’ve hired the best engineers, invested in expensive security tools, or Claude Code/Codex told you everything is secure. There’s always something you might have missed.

“He who would accomplish little must sacrifice little; he who would achieve much must sacrifice much; he who would attain highly must sacrifice greatly.” — James Allen Sacrifice is inseparable from achievement. Every ambition demands a price. Sometimes it’s time, sometimes comfort, and sometimes it’s the willingness to walk away from opportunities that don’t align with a greater purpose. You cannot pursue extraordinary outcomes while remaining attached to every comfort that ordinary life offers. But sacrifice alone guarantees nothing. It must be guided by purpose, sound judgment, and consistent action. Ambition determines what you want. Sacrifice reveals what you are willing to give in pursuit of it.

A few days ago, while creating some CTF challenges, I needed to test several token-based attacks using JWT Security Checker (xJWT.io). While running the tests, I realised two things: the interface needed some improvement, and there was an opportunity to automate much of the repetitive work involved in JWT security testing. So I decided to rebuild it. The latest version of xjwt.io now comes with a completely redesigned interface for decoding, inspecting, editing, signing, verifying, and testing JWTs. Here’s what’s new: