mars MARS-390

Consolidate 5 cron token checks to timingSafeEqual

Done normal unassigned

MED per Codex audit. 5 cron routes compare their bearer with plain !== (non-constant-time). Extract a shared timingSafeEqual helper, route all 5 through it. Class-A (auth). Reversible.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Activity

wi-cli-venus created · 2026-07-03
wi-cli-venus completed · 2026-07-03

Constant-time cron bearer compare — shared src/lib/timing-safe.ts (node:crypto timingSafeEqual) wired to all 5 cron routes. Live 2.24.4, PASS:51c474d.

Status

Priority

Assignee

Parent

Type

coder

Created

2026-07-03 by wi-cli-venus

Updated

2026-07-03

Closed

2026-07-03 10:15