Cron route authorization compares Buffers of unequal length via timingSafeEqual without short-circuit safety, but bypasses constant-time when lengths differ

Opus finding

Cron route authorization compares Buffers of unequal length via timingSafeEqual without short-circuit safety, but bypasses constant-time when lengths differ

• apps/web/app/api/cron/sweep/route.ts:30-38

The comment promises constant-time compare to deny a length oracle, but the code itself short-circuits on `a.length !== b.length`. This leaks the expected token length via timing — though only the length, not contents. The mitigation is to compute a fixed-length compare (e.g., pad provided to expected length and always run timingSafeEqual, then check lengths separately). For Vercel cron protected behind edge, the risk is minimal but the comment is misleading.