Function safeCompare

packages/security/src/compare.ts:8–13

(a: string, b: string)

 * secrets where leaking length or content via timing must be avoided.
 */
export function safeCompare(a: string, b: string): boolean {
  const key = 'safeCompare'
  const ha = createHmac('sha256', key).update(a).digest()
  const hb = createHmac('sha256', key).update(b).digest()
  return timingSafeEqual(ha, hb)
}