&gt;- A timing attack if you&#x27;re using HTTP basic auth<p>I&#x27;d say that qualifies as pretty bad.<p>How the hell does that even happen? Using time constant string comparison is authentication 101. That&#x27;s really not something you can mess up by mistake, it&#x27;s something you mess up by not understanding what you&#x27;re doing. And that&#x27;s is all ignoring the fact that there&#x27;s no reason to not use hashing here.