All rules →
Rules / Python
SHIELD-PY-017

Timing attack in string comparison

mediumPythonCWE-208CVSS 5.3

What it detects

Using == for secret comparison is vulnerable to timing attacks.

How to fix

Use hmac.compare_digest() for constant-time string comparison of secrets.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-017: Timing attack in string comparison — Zennoxa Shield