The only JWT security testing ... Note