webhook: compare secret in constant time

payload.secret != expected_secret short-circuits on the first differing byte, which leaks timing information about how many leading bytes of a guess are correct. Use subtle::ConstantTimeEq instead.
2026-08-13 02:10:09 +00:00 · 2026-08-13 02:10:09 +00:00 · 1473e726f3
commit 1473e726f3
parent 85369069c3
2 changed files with 5 additions and 1 deletions
--- a/Cargo.toml
+++ b/Cargo.toml
@ -18,6 +18,7 @@ reqwest = {
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
+subtle = "2"
 sqlx = {
  version = "0.8",
  features = [