Constant-time internal-auth secret compare (timing oracle)

Shipped: July 8, 2026 at 4:38 AM UTC
Author: Kamo
Commit: 62831ce

Replace String.equals with MessageDigest.isEqual so response latency cannot leak the X-Internal-Auth shared secret byte-by-byte. Fleet-wide sweep of the copy-pasted InternalAuthFilter (same fix already shipped in the eClose and underwriting services).

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing