fix: prevent timing attacks