diff --git a/cli/templates/features/auth/files/lib/auth.ts b/cli/templates/features/auth/files/lib/auth.ts
index bb6777cec5..805c22f9e8 100644
--- a/cli/templates/features/auth/files/lib/auth.ts
+++ b/cli/templates/features/auth/files/lib/auth.ts
@@ -1,3 +1,5 @@
+import crypto from "node:crypto";
+
 export async function hashPassword(password: string): Promise<string> {
   const msgBuffer = new TextEncoder().encode(password);
   const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
@@ -8,5 +10,7 @@ export async function hashPassword(password: string): Promise<string> {
 
 export async function verifyPassword(password: string, hash: string): Promise<boolean> {
   const computedHash = await hashPassword(password);
-  return computedHash === hash;
+  const actual = crypto.createHash('sha256').update(computedHash).digest();
+  const expected = crypto.createHash('sha256').update(hash).digest();
+  return crypto.timingSafeEqual(actual, expected);
 }
diff --git a/src/transforms/esm/bundle-recovery.ts b/src/transforms/esm/bundle-recovery.ts
index 1e60a8bcd8..d887a300e4 100644
--- a/src/transforms/esm/bundle-recovery.ts
+++ b/src/transforms/esm/bundle-recovery.ts
@@ -8,6 +8,7 @@
  * @module transforms/esm/bundle-recovery
  */
 
+import crypto from "node:crypto";
 import { createFileSystem, exists } from "#veryfront/platform/compat/fs.ts";
 import { join } from "#veryfront/compat/path/index.ts";
 import { rendererLogger } from "#veryfront/utils";
@@ -80,7 +81,9 @@ export async function recoverHttpBundleByHash(
         let m: RegExpExecArray | null;
         while ((m = BUNDLE_RE.exec(cachedCode)) !== null) {
           const tHash = m[2]!;
-          if (tHash === hash) continue;
+          const actual = crypto.createHash('sha256').update(tHash).digest();
+          const expected = crypto.createHash('sha256').update(hash).digest();
+          if (crypto.timingSafeEqual(actual, expected)) continue;
           transitiveDeps.push({
             path: join(absoluteCacheDir, `http-${tHash}.mjs`),
             hash: tHash,