- Shipped
- August 25, 2026 at 9:34 PM UTC
- Author
- Kamo
- Commit
- 7022b25
validateSignature used to return true three ways without verifying anything: a null secret short-circuited, six of eleven provider types fell through default -> true, and validateHmac compared with String.equals, which leaks the position of the first mismatch through timing. The endpoint it guards (POST **************** is public and unauthenticated, so this check was its only guard. Now: a null/blank secret rejects, the provider->header switch is exhaustive over RetailProviderType with no default arm (a twelfth provider becomes a compile error, not a silent accept), and the HMAC compare decodes both sides to bytes and uses MessageDigest.isEqual.