Highsrc/auth.ts:23security
Direct equality check in verify() is vulnerable to timing attacks.
A timing attack can be performed by comparing the time taken to execute the comparison.
Suggested fix: Use `timingSafeEqual` for constant-time comparison.
Confirmedreturn sign(value, secret) === signature; This line directly compares the hex strings generated by the HMAC function, which is susceptible to timing attacks as the finding suggests.