# X_SECRET_COMPARED_UNSAFELY

## Means

a value whose **name** says it is a secret is compared with `===`, `!==`, `.includes()`, `.equals()` or `Buffer.compare()`

## Typical cause

a short-circuiting comparison's running time depends on how many leading bytes match, so an attacker learns the value one byte at a time. It must be static and not a test: all twelve `timingSafeEqual` call sites in `@ultimat3/auth` were rewritten to `(a) === (b)` and the package still answered 432 pass · 0 fail, `session.test.ts` included — the difference between the two spellings is a timing distribution, not a return value, so no suite can hold this rule. Reads the NAME of each operand, never its type: `tokenHash === record.tokenHash` is reported, `a === b` is not

## Fix

replace the comparison with `timingSafeEqual(a, b)` from `@ultimat3/core`; if the name is not a secret, pin that site (`<path>: <comparison>`) in `scripts/lib/secret-compare-pins.ts` with the sentence saying what it is

[CLI and verify](/error-codes#cli-and-verify)