A JWT Expiry Race, 2FA Copy, and Client-Side Password Encryption: Three Account Security Fixes
My lending platform can reach users' exchange API keys, so after launch I fixed three account security issues: checking security copy against the backend, parsing JWTs once to avoid an expiry race, and encrypting passwords before sending.
