From 169034a63cf9df8584b12dc29662a3bb5c655dce Mon Sep 17 00:00:00 2001
From: Dominic Ferrando <dominicf2001@gmail.com>
Date: Sat, 18 Jul 2026 00:34:07 -0400
Subject: [PATCH] Replace password comparison with timingSafeEqual

---
 apps/api/src/server.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/api/src/server.ts b/apps/api/src/server.ts
index 34d7a46..f1386f3 100644
--- a/apps/api/src/server.ts
+++ b/apps/api/src/server.ts
@@ -122,7 +122,8 @@ export const app = new Elysia()
 
     // AUTHENTICATION
     .post("/auth/login", async ({ jwt, body, cookie: { auth } }) => {
-        if (body.password !== env.ADMIN_PASSWORD) throw status(401, "Invalid credentials");
+        const match = crypto.timingSafeEqual(Buffer.from(body.password, "hex"), Buffer.from(env.ADMIN_PASSWORD, "hex"));
+        if (!match) throw status(401, "Invalid credentials");
 
         auth.set({
             value: await jwt.sign({ sessionId: randomUUIDv7(), exp: JWT_EXP }),