https://reversethatapp.github.io/disclosures/parentcommapp-broken-jwt-hardcoded-shared-secret/