fix(api): require bootstrap secret strictly with constant-time comparisonBrowse files at 3381ae3 stripsior committed 2 months ago · 1 changed file
Fail closed when BOOTSTRAP_SECRET is unset instead of trusting the absence of proxy headers; timingSafeEqual for the header check.