Remove sensitive claims from JWT payloads
JWT payloads should avoid embedding PII or secrets unless absolutely required.
#Metadata
#Why it matters
Client-visible tokens often outlive a single request and can leak more data than intended.
#Remediation
Keep JWT claims minimal. Prefer stable identifiers, not direct PII or secret-bearing fields.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.jwt-sensitive-claims.rule.yaml.