# Timing / side-channel comparison pre-scan

- target: `/workspace/research/agenticjobs`
- source files scanned: 254
- findings: HIGH 1 · MEDIUM 0 · LOW 1 · INFO 0

_Deterministic pre-scan — not an audit. Line/window-based; no dataflow. A clean report is not proof of constant-time behavior._


## HIGH

- `test/api.test.ts:1763` **T-SECRET-EQ** — early-exit `!==` on secret-named operand — leaks the first differing byte per probe; use a constant-time compare (compare_digest / timingSafeEqual / subtle.ConstantTimeCompare / hash_equals)

## LOW

- `src/core/push.ts:176` **T-LEN-LEAK** — length compare on secret-named data — length oracle (also short-circuits the real compare)