14 if (!decoded.exp) return null; // BUG: no expiry claim validation
15 return decoded;
16 const now = Math.floor(Date.now() / 1000);
17 if (decoded.exp < now) return null; // token expired
CF
CodeFlowjust now · AI review
BUG — Missing token expiry check
If a token is created without an exp claim, jwt.decode() returns it as valid forever. An attacker who obtains the token (e.g., from a log or verbose response) could use it indefinitely. Add exp validation before line 15, or reject tokens without an expiry claim at creation time. Also consider using jwt.decode() instead of jwt.verify() here — decode() does not validate signature or expiry, which is a footgun. Recommend switching to jwt.verify() with a try/catch and explicit expiry check. This was caught automatically.
Common questions
Do I need a GitHub account?
Yes — CodeFlow connects via webhook to receive PR events and post review comments directly on your PRs.
Can I change plans later?
Yes — upgrade or downgrade anytime. Changes take effect at the next billing cycle.
How does AI review work?
When a PR is opened, CodeFlow receives the webhook, fetches the diff, runs it through OpenAI for analysis, and posts review comments to your PR — fully automatic.
Is there a free trial?
The Solo plan starts at $19/mo. Connect one repo and see the value immediately.
If a token is created without an
expclaim,jwt.decode()returns it as valid forever. An attacker who obtains the token (e.g., from a log or verbose response) could use it indefinitely. Addexpvalidation before line 15, or reject tokens without an expiry claim at creation time. Also consider usingjwt.decode()instead ofjwt.verify()here —decode()does not validate signature or expiry, which is a footgun. Recommend switching tojwt.verify()with a try/catch and explicit expiry check. This was caught automatically.