What's at stake

• Critical
  Unconstrained JWKS fetch creates SSRF and key-substitution attack surface: any caller can supply an arbitrary URL, allowing an attacker to redirect key resolution to a malicious server and substitute a trusted key with one they control…↳ Complete compromise of the product's core trust guarantee. An attacker who can influence the jwks_url parameter (trivially possible via E5's CLI override) can make fraudulent receipts verify as authentic. This is a product-killing vulnerability in any regulated or enterprise context; a single disclosed exploit ends the sales cycle and triggers customer…✓E3 · index.mjs✓E4 · index.mjs:68✓E5 · cli.mjs:45
• Critical
  Key-selection fallback silently accepts the first available key when no kid match is found — a one-line logic error that turns a key-mismatch (which should be a hard rejection) into a silent acceptance of an unintended key.↳ Directly amplifies the SSRF risk: an attacker who injects a JWKS response with a single key bypasses kid-based key binding entirely. Even without SSRF, a misconfigured or rotated key set silently verifies receipts against the wrong key. Enterprise zero-trust buyers will reject any verifier with this behavior on inspection; it is a contractual liability in…✓E1 · index.mjs:73
• High
  Signature is computed over a 32-byte hash of the payload, not over the payload itself — a non-standard construction that deviates from Ed25519 best practice and introduces a second pre-image risk surface.↳ Enterprise security reviewers and compliance auditors will flag this immediately. Without a documented, formally reviewed rationale, it is a deal-blocker in regulated industries (fintech, healthcare, government). It also creates a latent correctness risk: if the hash function or its input changes, the signature scheme silently breaks without any test suite…✓E2 · index.mjs:63✓E6 · index.mjs:58
• High
  Zero automated test coverage across the entire verification pipeline — no tests for canonicalization, hashing, signature verification, Merkle checks, or JWKS key resolution.↳ Every fix shipped to the four issues above carries unquantifiable regression risk. No enterprise buyer or compliance framework accepts a security-critical library with zero test coverage. This is also a direct valuation threat: acquirers and institutional investors conducting technical due diligence will discount or block a deal on this finding alone…◌inference — beyond sealed evidence

Both benches confirmed

• ✓The core verification pipeline is functionally operational for non-adversarial inputs — the product works in a trusted, controlled environment.
• ✓The SSRF and key-confusion risks are not theoretical: they are grounded in specific, machine-verified lines of code (E1, E3, E4, E5) and require no exotic attack conditions.