Verify GitHub's X-Hub-Signature-256 over the RAW bytes, constant-time.
crypto.subtle.verify is the constant-time comparison (never a string ===),
so a valid-length forged signature reveals nothing through timing. A missing
header, wrong prefix, non-hex, or wrong-length signature all fail closed.
Verify GitHub's
X-Hub-Signature-256over the RAW bytes, constant-time.crypto.subtle.verifyis the constant-time comparison (never a string ===), so a valid-length forged signature reveals nothing through timing. A missing header, wrong prefix, non-hex, or wrong-length signature all fail closed.