It's completely possible to do insecure things with PAST. There is always going to be someone who hardcodes the root password into a public GitHub repo. The p

It's completely possible to do insecure things with PAST. There is always going to be someone who hardcodes the root password into a public GitHub repo. The problem with JWT is IMO largely that things became too easy, so people coded without thinking. I'm not sure that's easy to prevent. I don't blame the JWT spec for mistakes that are so obvious.