🛡️ Sentinel: Hardened timing-safe comparison and added Telegram secret filtering

[SuvenSeo]

🛡️ Sentinel: Security Hardening & Secret Filtering

🚨 Severity: HIGH (Timing Attack Mitigation) / MEDIUM (Secret Filtering)

💡 Vulnerability

1. Timing Attack: The safeEqual and safeEqualText utilities were susceptible to length-based timing attacks because they performed an early return if input lengths differed.
2. Secret Leakage: Telegram messages were not being filtered for sensitive content (API keys, passwords) before being persisted and processed by LLMs.

🎯 Impact

1. Timing Attack: An attacker could potentially brute-force the length of a secret token by measuring response times, significantly reducing the search space for a full brute-force attack.
2. Secret Leakage: Sensitive credentials could be logged to the database or exposed to the AI model, increasing the risk of accidental exposure or misuse.

🔧 Fix

1. Hardened Equality Checks: Updated safeEqual (Node.js) and safeEqualText (Edge/SubtleCrypto) to hash both inputs with SHA-256 before constant-time comparison. This ensures fixed-length buffers (32 bytes) are always compared, eliminating length side-channels.
2. Proactive Filtering: Integrated hasSensitiveContent into the Telegram message handler to intercept and refuse processing of messages that look like secrets.

✅ Verification

• Ran npm test in the frontend directory: All 34 tests passed, including authentication and webhook verification.
• Verified code changes for correctness and potential side effects.
• Updated .jules/sentinel.md with documented vulnerabilities and preventions.

---

PR created automatically by Jules for task 17546227515962454379 started by @SuvenSeo

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
seo-os-agent	Ready	Preview, Comment	Jun 5, 2026 7:53pm

[Copilot]

Pull request overview

This PR hardens secret/token comparisons to avoid length-based timing side-channels and adds Telegram message ingestion filtering to prevent sensitive-looking user content from being processed or persisted.

Changes:

• Updated Node (safeEqual) and Edge (safeEqualText) equality checks to compare fixed-length SHA-256 digests in constant time.
• Added hasSensitiveContent gating in the Telegram handleMessage path to refuse processing of messages that look like credentials/secrets.
• Added .jules/sentinel.md documenting the vulnerabilities and mitigations.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
frontend/src/proxy.js	Makes safeEqualText async and hashes inputs before constant-time comparison in the proxy/middleware path.
frontend/src/lib/middleware/auth.js	Hardens safeEqual by hashing both inputs before timingSafeEqual.
frontend/src/lib/handlers/messageHandler.js	Rejects sensitive-looking Telegram messages early and logs a security event.
.jules/sentinel.md	Documents the timing-attack and secret-filtering mitigations introduced by this PR.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.