[claude]

Requested by Samuel Attard · Slack thread

timingSafeEqual called Buffer.from() on req.headers.authorization, which throws a TypeError when the header is missing, so unauthenticated requests to /verify-semver and /unreleased returned 500 instead of 401. A non-string value is now treated as a mismatch (still doing the dummy constant-time compare against the secret), and a new test/helpers.spec.js covers the missing-header case.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. It changes the shared credential check that guards server endpoints, and CODEOWNERS covers it, so a human from the owning team should still take a look.

What was reviewed:

• The new non-string guard in timingSafeEqual (utils/helpers.js). A missing or null a now returns false. It runs the same dummy crypto.timingSafeEqual(bufferB, bufferB) as the length-mismatch path, so it still fails closed with matching timing.
• The guard at line 218 for an unset or empty secret still runs first, so a blank secret can never match.
• The callers in server.js (lines 46 and 292) and in verifySlackRequest (line 274) only test the boolean result, so returning false instead of throwing leads to the existing 401 path.

Extended reasoning...

The change touches timingSafeEqual in utils/helpers.js, the constant-time comparison behind the auth checks in server.js and the Slack signature check. It also adds a node:test spec for that function. The logic is small and fails closed, and the new tests cover missing-header and unset-secret inputs. However, this is security-sensitive auth and crypto code, and the CODEOWNERS file assigns every path to a review team. That is why this defers to a human instead of approving.