If your refresh token gets stolen, rotation alone won't save you — here's what d

<blockquote> <p><em>JWT tutorials only teach the easy part. Here's what happens after.</em></p> </blockquote> <p>Most auth tutorials end at "user logs in, gets a token, done." And

<p>Two months ago I shipped UNPWNED, a passive web security scanner aimed at indie hackers and developers shipping AI-generated code (Cursor, Lovable, Bolt, Replit, v0).</p> <p>I

<p>I recently wrote a sentence I need to correct: “DPoP stops replay. The gap most teams miss is revocation lag once the token walked.” The second half points at a real problem.