Audit how my app issues and validates JWTs (or skip this if my app uses server-side sessions instead; tell me which it uses first). Check each of these: the signing secret or private key is long, random, and loaded from an environment variable (not hardcoded, not a short string like "secret"); the algorithm is pinned explicitly (HS256 or RS256 as appropriate) so an attacker can't downgrade to alg=none or swap RS256 for HS256 with the public key; every protected endpoint validates the signature, expiry, issuer, and audience on each request; tokens have a reasonable expiry (short-lived access tokens, with refresh tokens if sessions need to be long); and sensitive claims like roles are never trusted from the client without re-validation against the token or database. Do not migrate to a different auth scheme. Fix the JWT handling in place. If you find alg=none acceptance or a hardcoded weak secret, treat it as critical: fix the code and tell me to rotate the secret immediately, since any token signed with the old one is forgeable. Deliver a findings list with severity, each fix applied, and verification steps: a forged token with a wrong signature that gets rejected, an expired token that gets rejected, and (if applicable) an alg=none token that gets rejected.