Why is crypto.timingSafeEqual the wrong tool for comparing two HMAC hex digests of potentially different lengths, and what happens if you pass it mismatched-length buffers?timingSafeEqual(Buffer.from('abc'), Buffer.from('abcd'));
