Daily security quiz #10

Question for 2026-11-10. Read the code and pick the most serious security vulnerability.

This code verifies a signature to check whether a webhook request came from a legitimate sender. What is the most serious vulnerability?

1import hmac, hashlib
2 
3SECRET = load_secret()
4 
5def verify(body: bytes, signature: str) -> bool:
6    expected = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
7    return expected == signature

1. ASHA-256 is unsafe because it has known collisions
2. Bdigest should be used instead of hexdigest
3. CComparison with == does not take constant time, so differences in response time can leak information about the correct signature (timing attack)
4. DSECRET is exposed because it is defined outside the function