1 - Stop using JWTs would be a better first step, go to https://paseto.io

2 - Look at the network tab, see anything leaving your browser, websockets whatever ? if not, it's probably fine