Security context

Highlights

Timing Attack: 1 prior fix. Scrutinize any change in this area.

src/Signers/Hmac.php: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Timing Attack: The HMAC signature verification originally used standard comparison operators, which are susceptible to timing side-channel attacks. An attacker could exploit this timing difference to incrementally forge valid HMAC signatures, potentially leading to unauthorized deserialization of arbitrary closures.