Check a credential for risk#

A credential can decode cleanly and still be dangerous. The Security Audit tab answers the question a decode leaves open: given what this credential says about itself, what would a reviewer object to?

Every protocol has its own audit, and it runs automatically whenever you decode something. There is no button to press.

The five severity bands#

The header counts the issues and breaks them down by severity. Each finding gives you a title, the severity, a description of what is wrong, and a recommendation for what to do about it.

Severity runs across five bands.

Severity	What it means
Critical	The credential cannot be trusted as it stands. Signature bypass, expiry, or plaintext transport.
High	A serious weakness a reviewer would block on, such as a missing expiry or a broken algorithm.
Medium	A real weakness that is not a direct bypass, such as a symmetric algorithm or a missing audience restriction.
Low	Hygiene. A missing standard field, or a detail that will cause trouble later.
Info	Context rather than a problem, including the summary line describing what was found.

When nothing is wrong, the panel says so instead of showing an empty list.

What each protocol is checked for#

The checks follow the ways each protocol breaks in practice.

JWT covers the classics.

• alg of none: critical.
• Missing exp claim: high.
• Symmetric signing algorithm: medium.
• Lifetime over 24 hours: medium.
• Missing standard claims: low.
• Expiry and clock-skew observations: info.

An alg of none is critical because a verifier can skip signature validation entirely. A symmetric algorithm is medium because you have to share the secret with everyone who verifies the token.

SAML is mostly about whether the assertion can be forged or replayed.

• Unsigned assertion: critical.
• Expired assertion: high.
• Missing audience restriction: high.
• SHA-1 signature: medium.
• Missing conditions element: medium.
• Missing issuer, name identifier, authentication context, or session index: low.

OAuth checks the shape of an authorisation request.

• HTTP instead of HTTPS on the endpoint: critical.
• Implicit flow: high.
• Missing PKCE challenge: medium.
• A plain rather than S256 challenge method: medium.
• Missing state parameter: medium.

These checks apply to authorisation URLs. Tokens, discovery documents, and JWKS sets decode without an audit.

X.509 checks the certificate's validity, its algorithms, and its key.

• Expired certificate: critical.
• Not-yet-valid certificate: critical.
• SHA-1 or MD5 signature: high.
• RSA key under 2048 bits: high.
• Self-signed certificate: medium.
• Missing subject alternative name: medium.
• Validity period over 397 days: medium.
• Missing revocation endpoint: low.

Kerberos is about encryption strength.

• RC4 ticket encryption: critical.
• DES ticket encryption: high.

RC4 is critical because it makes Kerberoasting practical.

Findings in Compare and History#

The audit is not confined to this tab. Compare runs the same checks on both sides and shows the counts above each column, so you see whether a credential got safer or riskier between two versions. History puts the worst finding on each entry as a chip, so a list of past credentials doubles as a list of problems.