fix(gate): use timingSafeEqual to prevent timing attacks on password check

[Sertug17]

Closes #51

What

Replace the plain !== password comparison in app/api/gate/route.ts with timingSafeEqual from node:crypto.

Why

!== short-circuits on the first mismatched character. An attacker measuring response latency across many /api/gate requests can converge on the correct password one character at a time (linear instead of exponential search).

timingSafeEqual always runs in constant time regardless of where the buffers differ, closing that channel.

Changes

• Import timingSafeEqual from node:crypto
• Convert both strings to Buffer before comparing
• Check length first (not timing-sensitive; required by timingSafeEqual)
• Replace if (provided !== password) with the safe comparison

Testing

No new tests the gate is a temporary mechanism and has no existing test coverage. The fix is a drop in replacement with identical behaviour for correct passwords and incorrect ones; only the timing characteristic changes.

[vercel]

@Sertug17 is attempting to deploy a commit to the Coinbase Team on Vercel.

A member of the Team first needs to authorize it.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[Sertug17]

Hi, I found this while reviewing the codebase.

The /api/gate endpoint compares the submitted password using !==, which is timing-sensitive an attacker can measure response latency to narrow down the correct password character by character.

Happy to add tests or adjust anything if needed. Thanks for taking a look!