challenges/expert_vault.py compares the Expert Access Key with access_key.strip() == globals().get("_VALID_KEY"). app.py already does this
correctly for flags in /api/submit using hmac.compare_digest. The unlock path should match. Also worth storing a SHA-256 digest in _VALID_KEY rather than the key in cleartext.
File: challenges/expert_vault.py
challenges/expert_vault.pycompares the Expert Access Key withaccess_key.strip() == globals().get("_VALID_KEY").app.pyalready does thiscorrectly for flags in
/api/submitusinghmac.compare_digest. The unlock path should match. Also worth storing a SHA-256 digest in_VALID_KEYrather than the key in cleartext.File: challenges/expert_vault.py