@@ -31,7 +31,7 @@ jobs:
       - name: Install Dependencies
         run: pip install -r requirements/lint.txt
       - name: Black Format Check
-        run: black --check .
+        run: black --check . --exclude samples/
       - name: Run pylint
         run: make lint
 
 
@@ -11,6 +11,7 @@ repos:
     rev: 23.9.1
     hooks:
     -   id: black
+        exclude: samples/
 - repo: https://github.com/pre-commit/mirrors-mypy
   rev: v1.5.1
   hooks:
 
@@ -0,0 +1,27 @@
+from codemodder.codemods.jwt_decode_verify import JwtDecodeVerify
+from integration_tests.base_test import (
+    BaseIntegrationTest,
+    original_and_expected_from_code_path,
+)
+
+
+class TestJwtDecodeVerify(BaseIntegrationTest):
+    codemod = JwtDecodeVerify
+    code_path = "tests/samples/jwt_decode_verify.py"
+    original_code, expected_new_code = original_and_expected_from_code_path(
+        code_path,
+        [
+            (
+                10,
+                """decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=True)\n""",
+            ),
+            (
+                11,
+                """decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": True})\n""",
+            ),
+        ],
+    )
+    expected_diff = '--- \n+++ \n@@ -8,7 +8,7 @@\n \n encoded_jwt = jwt.encode(payload, SECRET_KEY, algorithm="HS256")\n \n-decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=False)\n-decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": False})\n+decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=True)\n+decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": True})\n \n var = "something"\n'
+    expected_line_change = "11"
+    num_changes = 2
+    change_description = JwtDecodeVerify.CHANGE_DESCRIPTION
@@ -19,6 +19,7 @@
 from codemodder.codemods.tempfile_mktemp import TempfileMktemp
 from codemodder.codemods.requests_verify import RequestsVerify
 from codemodder.codemods.use_walrus_if import UseWalrusIf
+from codemodder.codemods.jwt_decode_verify import JwtDecodeVerify
 
 DEFAULT_CODEMODS = [
     DjangoDebugFlagOn,
@@ -38,6 +39,7 @@
     TempfileMktemp,
     RequestsVerify,
     UseWalrusIf,
+    JwtDecodeVerify,
 ]
 ALL_CODEMODS = DEFAULT_CODEMODS
 
 
@@ -0,0 +1,18 @@
+This codemod ensures calls to [jwt.decode](https://pyjwt.readthedocs.io/en/stable/api.html#jwt.decode) do not disable signature validation and other
+verifications. It checks that both the `verify` parameter (soon to be deprecated) and any `verify` key in the `options` dict parameter are not assigned to `False`.
+
+Our change looks as follows:
+
+```diff
+  import jwt
+  ...
+- decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=False)
++ decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=True)
+  ...
+- decoded_payload = jwt.decode(
+    encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": False, "verify_exp": False})
++ decoded_payload = jwt.decode(
+    encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": True, "verify_exp": True})
+```
+
+Any `verify` parameter not listed relies on the secure `True` default value.
@@ -0,0 +1,90 @@
+import libcst as cst
+from libcst import matchers
+from codemodder.codemods.base_codemod import ReviewGuidance
+from codemodder.codemods.api import SemgrepCodemod
+
+
+class JwtDecodeVerify(SemgrepCodemod):
+    NAME = "jwt-decode-verify"
+    REVIEW_GUIDANCE = ReviewGuidance.MERGE_WITHOUT_REVIEW
+    SUMMARY = "Enable all verifications in `jwt.decode` call."
+    DESCRIPTION = "Makes any of the multiple `verify` parameters to a `jwt.decode` call be `True`."
+
+    @classmethod
+    def rule(cls):
+        return r"""
+            rules:
+                - pattern-either:
+                  - patterns:
+                      - pattern: jwt.decode(..., verify=False, ...)
+                      - pattern-inside: |
+                          import jwt
+                          ...
+                  - patterns:
+                      - pattern: |
+                          jwt.decode(..., options={..., "$KEY": False, ...}, ...)
+                      - metavariable-regex:
+                          metavariable: $KEY
+                          regex: verify_
+                      - pattern-inside: |
+                          import jwt
+                            ...
+        """
+
+    def _replace_opts_dict(self, opts_dict):
+        new_dict_elements = []
+
+        for element in opts_dict.elements:
+            if is_verify_keyword(element):
+                new_el = cst.DictElement(
+                    key=cst.parse_expression(element.key.value),
+                    value=cst.parse_expression("True"),
+                )
+            else:
+                new_el = element
+            new_dict_elements.append(new_el)
+        return new_dict_elements
+
+    def replace_options_arg(self, node_args):
+        new_args = []
+        for arg in node_args:
+            if matchers.matches(arg.keyword, matchers.Name("options")) and isinstance(
+                opts_dict := arg.value, cst.Dict
+            ):
+                new_dict_elements = self._replace_opts_dict(opts_dict)
+                new = cst.Arg(
+                    keyword=cst.parse_expression("options"),
+                    value=cst.Dict(
+                        elements=new_dict_elements,
+                    ),
+                    equal=arg.equal,
+                )
+            else:
+                new = arg
+            new_args.append(new)
+        return new_args
+
+    def replace_arg(self, original_node, target_arg_name, target_arg_replacement_val):
+        new_args = super().replace_arg(original_node, "verify", "True")
+        return self.replace_options_arg(new_args)
+
+    def on_result_found(self, original_node, updated_node):
+        new_args = self.replace_arg(original_node, "verify", "True")
+        return self.update_arg_target(updated_node, new_args)
+
+
+def is_verify_keyword(element: cst.DictElement) -> bool:
+    """Determine if DictElement is something like:
+        DictElement(
+            key=SimpleString(
+                value='"verify_signature"',
+                lpar=[],
+                rpar=[],
+            )
+            ...
+    where value should be anything with the word `verify`
+    """
+    return (
+        matchers.matches(element.key, matchers.SimpleString())
+        and "verify" in element.key.value
+    )
@@ -0,0 +1,136 @@
+import pytest
+from codemodder.codemods.jwt_decode_verify import JwtDecodeVerify
+from tests.codemods.base_codemod_test import BaseSemgrepCodemodTest
+
+
+class TestJwtDecodeVerify(BaseSemgrepCodemodTest):
+    codemod = JwtDecodeVerify
+
+    def test_rule_ids(self):
+        assert self.codemod.RULE_IDS == ["jwt-decode-verify"]
+
+    def test_import(self, tmpdir):
+        input_code = """import jwt
+
+jwt.decode(encoded_jwt, SECRET_KEY, algorithms=['HS256'], verify=False)
+var = "hello"
+"""
+        expexted_output = """import jwt
+
+jwt.decode(encoded_jwt, SECRET_KEY, algorithms=['HS256'], verify=True)
+var = "hello"
+"""
+
+        self.run_and_assert(tmpdir, input_code, expexted_output)
+
+    def test_from_import(self, tmpdir):
+        input_code = """from jwt import decode
+
+decode(encoded_jwt, SECRET_KEY, algorithms=['HS256'], verify=False)
+var = "hello"
+"""
+        expexted_output = """from jwt import decode
+
+decode(encoded_jwt, SECRET_KEY, algorithms=['HS256'], verify=True)
+var = "hello"
+"""
+
+        self.run_and_assert(tmpdir, input_code, expexted_output)
+
+    def test_import_alias(self, tmpdir):
+        input_code = """import jwt as _jwtmod
+
+_jwtmod.decode(encoded_jwt, SECRET_KEY, algorithms=['HS256'], verify=False)
+var = "hello"
+"""
+        expexted_output = """import jwt as _jwtmod
+
+_jwtmod.decode(encoded_jwt, SECRET_KEY, algorithms=['HS256'], verify=True)
+var = "hello"
+"""
+
+        self.run_and_assert(tmpdir, input_code, expexted_output)
+
+    @pytest.mark.parametrize(
+        "input_args,expected_args",
+        [
+            (
+                "",
+                "",
+            ),
+            (
+                "verify=True",
+                "verify=True",
+            ),
+            (
+                """verify=False, options={"verify_signature": False}""",
+                """verify=True, options={"verify_signature": True}""",
+            ),
+            (
+                """options={"verify_exp": False}""",
+                """options={"verify_exp": True}""",
+            ),
+            (
+                """options={"verify_iss": False, "verify_exp": False, }""",
+                """options={"verify_iss": True, "verify_exp": True}""",
+            ),
+            (
+                """options={"strict_aud": False, "verify_signature": False}""",
+                """options={"strict_aud": False, "verify_signature": True}""",
+            ),
+            (
+                """options={"verify_iss": True, "verify_signature": True}""",
+                """options={"verify_iss": True, "verify_signature": True}""",
+            ),
+        ],
+    )
+    def test_verify_variations(self, tmpdir, input_args, expected_args):
+        input_code = f"""import jwt
+
+jwt.decode(encoded_jwt, SECRET_KEY, algorithms=['HS256'], {input_args})
+var = "hello"
+"""
+        expexted_output = f"""import jwt
+
+jwt.decode(encoded_jwt, SECRET_KEY, algorithms=['HS256'], {expected_args})
+var = "hello"
+"""
+
+        self.run_and_assert(tmpdir, input_code, expexted_output)
+
+    def test_multiline_formatting_verify_flag(self, tmpdir):
+        input_code = """import jwt
+
+decoded_payload = jwt.decode(
+    encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=False
+)
+var = "hello"
+"""
+        expexted_output = """import jwt
+
+decoded_payload = jwt.decode(
+    encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=True)
+var = "hello"
+"""
+
+        self.run_and_assert(tmpdir, input_code, expexted_output)
+
+    @pytest.mark.parametrize("quote", ["'", '"'])
+    def test_multiline_formatting_options(self, tmpdir, quote):
+        input_code = f"""import jwt
+
+decoded_payload = jwt.decode(
+    encoded_jwt, SECRET_KEY, algorithms=["HS256"],
+    options={{{quote}verify_signature{quote}: False, {quote}verify_exp{quote}: False}}
+)
+var = "hello"
+"""
+        expexted_output = f"""import jwt
+
+decoded_payload = jwt.decode(
+    encoded_jwt, SECRET_KEY, algorithms=["HS256"],
+    options={{{quote}verify_signature{quote}: True, {quote}verify_exp{quote}: True}})
+var = "hello"
+"""
+
+        self.run_and_assert(tmpdir, input_code, expexted_output)
@@ -0,0 +1,14 @@
+import jwt
+
+SECRET_KEY = "mysecretkey"
+payload = {
+    "user_id": 123,
+    "username": "john",
+}
+
+encoded_jwt = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
+
+decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], verify=False)
+decoded_payload = jwt.decode(encoded_jwt, SECRET_KEY, algorithms=["HS256"], options={"verify_signature": False})
+
+var = "something"