I see a timing attack in the list. It&#x27;s fairly trivial to mitigate against this in the majority of languages nowadays [1] [2] [3] etc..<p>I presume this can also be mitigated by implementing rate limiting on your authentication endpoints, although that should also be implemented for other reasons.<p>[1] <a href="https:&#x2F;&#x2F;golang.org&#x2F;pkg&#x2F;crypto&#x2F;subtle&#x2F;#ConstantTimeCompare" rel="nofollow">https:&#x2F;&#x2F;golang.org&#x2F;pkg&#x2F;crypto&#x2F;subtle&#x2F;#ConstantTimeCompare</a><p>[2] <a href="http:&#x2F;&#x2F;php.net&#x2F;manual&#x2F;en&#x2F;function.hash-equals.php" rel="nofollow">http:&#x2F;&#x2F;php.net&#x2F;manual&#x2F;en&#x2F;function.hash-equals.php</a><p>[3] <a href="http:&#x2F;&#x2F;www.levigross.com&#x2F;2014&#x2F;02&#x2F;07&#x2F;constant-time-comparison-functions-in...-python-haskell-clojure-and-java&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.levigross.com&#x2F;2014&#x2F;02&#x2F;07&#x2F;constant-time-comparison...</a>