Arnas Donauskas fe4e0117da fix(flows): constant-time compare for cron secret ... The `/api/flows/cron` route gated on `supplied !== expected`, which compares strings byte-by-byte with early exit on first mismatch. An attacker who can hit the endpoint could in principle recover the secret one byte at a time by measuring response-time deltas. With a high-entropy 64-char secret this is mostly theoretical, but the upgrade is a one-liner. Switch to crypto.timingSafeEqual with a length pre-check (the function throws on mismatched lengths; the length itself isn't sensitive when the expected value is set by the operator). Not touching the equivalent line in /api/automations/cron in this PR — one fix per branch keeps the diff easy to review and revert. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-22 15:51:34 +03:00
..
route.ts	fix(flows): constant-time compare for cron secret	2026-05-22 15:51:34 +03:00