video-sdk/web

The code appears to be legitimate Zoom Video SDK application code and shows no clear malware or intentional sabotage. The significant security concern is bearer-token exposure: JWTs are accepted from URL parameters, logged in full, and persisted in browser history and shareable URLs. Tokens should be passed through a protected mechanism such as a server-side session or short-lived fragment handling, never logged, and removed from the address bar immediately. The hardcoded plain-HTTP localhost token endpoint should also be configuration-driven and secured for non-development use.