gocardless/gocardless-ruby — pull request #68 by philnash (2014-10-26 17:31:40+00:00)
Title: Uses a constant time string comparison to avoid timing attacks.

Ruby's == string comparison will short circuit once it knows the string is not the same. This could allow a potential attacker to figure out the app secret with a timing attack against the user's webhook endpoint. This uses ActiveSupport's secure compare function to avoid that.

I've made this PR against the fix-spec-deprecations branch as I branched off there since the tests were broken for me on master.