Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access. https://securinglaravel.com/security-tip-your-jwt-might-be-a-forever-key/ #Laravel