jwt.decode used instead of jwt.verify — token signature not checked

What it is

jwt.decode() is used where jwt.verify() was intended. Decode parses the token and returns its claims without checking the signature at all.

Why it matters

Any user can hand-craft a token with whatever sub, role, or tenant_id they like and your app will trust it. There is no error and nothing in the logs — the claims simply come back as asked.

How to fix it

Replace with jwt.verify(), passing the key and an explicit algorithms list. Reserve decode for reading a token you have already verified, or for inspecting a token you do not trust and are not acting on.