Yes, you are right. You need to balance that tradeoff with your application/business risk profile. High-security applications or those not tailored for mobile c

Yes, you are right. You need to balance that tradeoff with your application/business risk profile. High-security applications or those not tailored for mobile can still lock the IP to the JWT.