base64urlDecode is permissive and may accept malformed input as valid

Opus finding

base64urlDecode is permissive and may accept malformed input as valid

• apps/web/lib/optin-token.ts:31-35

Node's Buffer.from(_, "base64") silently ignores characters outside the alphabet rather than throwing. A token whose payload segment contains stray characters (e.g. whitespace, special chars) could decode to a buffer that still passes the HMAC compare because expectedMac is computed over the raw encoded string, not the decoded one. This is not a forgery vector (HMAC still binds the exact encodedPayload string), but it does mean tokenLogId and the encodedPayload could include garbage that is logged downstream. Lower confidence because no exploitable path is obvious — the HMAC is computed over the exact incoming string, so a malformed encodedPayload that decodes to {} would still need a valid MAC, which requires the secret.