Highsrc/auth.ts:23security
Direct string comparison in the `verify` function is vulnerable to timing attacks.
If an attacker can measure the time taken for the comparison, they could potentially infer information about the secret or signature.
Suggested fix: Use `timingSafeEqual` for comparing signatures to mitigate timing attacks.
Confirmedreturn sign(value, secret) === signature; this line directly compares the signatures using the === operator, which is vulnerable to timing attacks as stated in the finding.