Of course you can improve the tooling but it's not the only conclusion. If you don't read the docs, don't have the right mentoring, etc etc, your first go at a

Of course you can improve the tooling but it's not the only conclusion. If you don't read the docs, don't have the right mentoring, etc etc, your first go at anything is likely to be of low quality. Calibrate your confidence better, especially for anything security-related. Don't put it into production if you've only skimmed the docs (the mistakes we're talking about are novice mistakes). Another conclusion you could draw is "use a built in security library not raw JWTs". There's just as much reason not to use a security library as there is not to use a SQL ORM.