Hacker News Reader

Some attacks exploit vulnerabilities in dev infrastructure. Exposed dev JWT token may enable such an attack.

This is precisely why my comment makes it clear that dev shouldn't be available to the outside world.

Security in layers. You should keep your dev environment private but also not paste credentials into a networked textbox.

This, I can't believe we are even debating it...

"making things not available to the outside world"

Has been proven repeatedly to not reliable work.

And security model must assume a attacker somehow got access to the VPN it whatever you use for isolation.

If not it's not a reliable security model.