T-Mobile does not take security seriously. I once encountered the infamous JWT alg: none bug in a series of codebases I worked on at T-Mobile. I built a PoC ex

T-Mobile does not take security seriously. I once encountered the infamous JWT alg: none bug in a series of codebases I worked on at T-Mobile. I built a PoC exploit that demonstrated complete bypass of all JWT user authN, publicized it to my team, and escalated it to my manager and later my skip level. The bug was never fixed and my attempts to ship a fix were never prioritized. I am only comfortable stating this now because the affected codebases are no longer in use.