We have all done it. You get a bug in a staging or production environment, you grab the JSON Web Token, and you paste it into the first search result to read the payload.

If you are handling proprietary data, API keys, or operating under strict compliance, this is a massive security leak. Many of...