From marketing site to first PR review, in three steps.

@@ -42,7 +42,9 @@ export async function verifySession

• 42
• const token = req.headers.get('authorization')?.slice(7)
• if (!token) throw new SessionError('missing token')
• − return jwt.verify(token, process.env.JWT_SECRET)
• −}
  Alert

  Pin the JWT algorithm to HS256.

  Without an explicit algorithms list, jwt.verify will accept any algorithm the token advertises — including "none" on misconfigured libs. Pin to an allow-list before merging.

• + const decoded = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] })
• + if (Date.now() - decoded.iat * 1000 > MAX_TOKEN_AGE_MS) {
  Info

  Token age check looks right.

  Comparing decoded.iat against MAX_TOKEN_AGE_MS prevents replay of long-lived session tokens. Verified against the OWASP ASVS V3 session-timeout control.

• + throw new SessionError('token too old')
• + }
• + return decoded
• +}

@@ -110,4 +114,6 @@ export async function enforceRateLimit

• 114
• const count = await redis.incr(key)
• if (count > limit) throw new RateLimitError()
• + if (count === limit + 1) {
• + await notifyOncall(key, count)
  Alert

  Pin the JWT algorithm to HS256.

  Without an explicit algorithms list, jwt.verify will accept any algorithm the token advertises — including "none" on misconfigured libs. Pin to an allow-list before merging.

• + }
• return { count, remaining: Math.max(0, limit - count) }
  Info

  Token age check looks right.

  Comparing decoded.iat against MAX_TOKEN_AGE_MS prevents replay of long-lived session tokens. Verified against the OWASP ASVS V3 session-timeout control.