AI-generated auth middleware had a flaw that let anonymous users bypass checkout

A developer discovered that an AI-generated authentication middleware contained a critical security flaw in a checkout endpoint. The bug arose because the code used a strict equality check between a request header and an environment variable, both of which resolve to undefined when the token is unconfigured, effectively granting anonymous requests full access. The missing environment variable was never documented in the project's .env.example file, making it easy to omit silently during deployment. Beyond the bypass risk, using === on secrets also enables timing attacks that can leak token values character by character. The fix involves validating that both the expected and provided tokens are non-empty strings before comparing them using a constant-time cryptographic function, and adding the token to .env.example.