security
Auth Configuration Audit
JWT expiry, CORS policy, session rotation — the class of bug behind the Moltbook breach.
What you get
The config attackers exploit
ZipLoom checks JWT expiry, CORS policy and session rotation — the auth-configuration mistakes that turn into breaches.
The Moltbook class of bug
This is the class of misconfiguration behind the Moltbook breach. ZipLoom makes it a standard check before deploy.
Expiry, rotation, and origin together
The audit inspects JWT expiry windows, whether sessions rotate, and which origins your CORS policy actually allows — the combination that turns one leaked token into standing access. Moltbook's 1.5M-token exposure was this class of misconfiguration, not a code bug.
How the audit works
- 1
ZipLoom inspects your auth configuration.
- 2
JWT expiry, CORS policy and session rotation are checked against safe defaults.
- 3
Misconfigurations are flagged before the deploy ships.
What this check inspects
Token lifetimes — access tokens that never expire turn a single leak into permanent access.
Whether sessions rotate on privilege change and are invalidated on logout.
CORS configuration, specifically wildcard origins combined with credentials, which lets any site call your API as your user.
Password and sign-up policy: minimum strength, email verification, and whether anyone can self-register into a privileged role.
What it means when this fails
Weak auth configuration doesn't look like a bug — the app works perfectly. It means that when one token leaks, through a log, a bundle, or a browser extension, the person holding it has standing access you cannot revoke. This class of misconfiguration, not a code flaw, is what exposed roughly 1.5 million user tokens in the Moltbook incident.
Questions
- My login works. What's left to audit?
- Whether it fails safely. Working login proves the happy path; the audit checks expiry, rotation, and which origins can use the session — the parts you only notice after something leaks.
- What's wrong with a wildcard CORS policy?
- With credentials enabled, it lets any website make authenticated requests to your API using your logged-in user's session. It's convenient in development and dangerous in production.
- Does this cover social and magic-link logins?
- The configuration checks apply to the session and token settings regardless of how the user signed in.
What it replaces
Snyk Team
Per contributing developer, 5-seat minimum (~$1,500/yr entry). Code + dependency scanning; does not deploy your app.
GitHub Code Security
CodeQL scanning, Dependabot, dependency review. Billed per active committer; GitHub repos only.
Semgrep Team
SAST with a strong free OSS engine; rules and triage are yours to maintain.
ZipLoom Solo — all 28 features included
Deploy, security scan, and monitoring in one flat price. Guild $40/mo · Studio $70/mo · Business $299/mo.
Related features