Highsrc/auth.ts:24security
The verify function now uses simple string comparison instead of constant-time comparison.
If the input strings are of different lengths, this could lead to a timing attack where an attacker can infer information about the secret.
Suggested fix: Use `timingSafeEqual` for comparing buffers to prevent timing attacks.
Confirmedreturn sign(value, secret) === signature; This line performs a simple string comparison between the expected and received signatures.