Reviewed 11 Sept, at b7ac2f2 — open the Check Run
Nothing was posted.
Below the posting bar, not confirmed by the second look, or already commented on by an earlier review.
Lowsrc/auth.ts:23correctness
Verification function now uses simple string comparison instead of `timingSafeEqual`.
String comparison can fail due to timing differences, leading to potential security issues.
Suggested fix: Use `timingSafeEqual` for signature verification to prevent timing attacks.
Not checked
Lowsrc/users.ts:35correctness
Function `hasActiveSession` might return false positives if session expiration is not correctly set.
If a user's session expires just before the check but still has some remaining time, it will be incorrectly marked as expired.
Not checked