Why HMAC-SHA256 instead of === ? === stops at the first wrong char. Fast fail = timing attack vector. HMAC + timingSafeEqual: every comparison takes identical time. Microseconds matter in security. #AppSec #InfoSec #DevTips