The JWT is signed (see LW_JWT_SECRET env variable), you'll want to check the signature before trusting the rest of the contents.