- password spray attack
- Ops also need to be tested: dev testing, rollback testing
- long lived token signing key
- out-of-dated token validation logic
- non-standard AuthN pattern
- not able to revoke centrally
- excessive app permission
- Secrets across boundaries