Summary

Two service authentication checks use direct === comparison for API key validation, which is vulnerable to timing attacks (CWE-208).

Locations

1. ee/apps/billing/app.ts, line 31: authToken === env.BILLING_KEY
2. apps/mail-bridge/app.ts, line 34: authToken === env.MAILBRIDGE_KEY

Impact

An attacker with network access can potentially extract service API keys through statistical analysis of response timing. The === operator short-circuits on the first differing character, leaking information about how many leading characters match.

Suggested Fix

Replace === with crypto.timingSafeEqual() using SHA-256 digests to ensure constant-time comparison regardless of input length.

Found by SpiderShield security scanner