1@README.md
2
3## Notes for agents
4
5**The signature is checked before any claim is read.** Keep that order; a claim
6read from an unsigned token is attacker text.
7
8**A Worker with no team or audience refuses everyone** (`NotConfigured`), so a
9missing variable fails closed. Never default either to something.
10
11**Only RS256 is accepted**, and `none` is refused by name in the tests. Do not
12add an algorithm without adding its refusal test first.
13
14**Do not re-export `rsa` or `base64` types.** The public surface is this crate's
15own `Key`, `Keys`, `Refused`.