Replace manual XOR loop with Node's native crypto.timingSafeEqual for constant-time secret comparison. Add tests verifying identical error messages for wrong secrets and <1ms response time variance across 100 requests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>