X_SECRET_COMPARED_UNSAFELY

a value whose name says it is a secret is compared with ===, !==, .includes(), .equals() or Buffer.compare()

a short-circuiting comparison's running time depends on how many leading bytes match, so an attacker learns the value one byte at a time. It must be static and not a test: all twelve timingSafeEqual call sites in @ultimat3/auth were rewritten to (a) === (b) and the package still answered 432 pass · 0 fail, session.test.ts included — the difference between the two spellings is a timing distribution, not a return value, so no suite can hold this rule. Reads the NAME of each operand, never its type: tokenHash === record.tokenHash is reported, a === b is not

replace the comparison with timingSafeEqual(a, b) from @ultimat3/core; if the name is not a secret, pin that site (<path>: <comparison>) in scripts/lib/secret-compare-pins.ts with the sentence saying what it is