diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 00000000..ab72462b
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2025-05-14 - Timing Attack in Token Validation
+**Vulnerability:** A timing attack vulnerability was found in `src/cli/commands/serve.ts` where the lengths of `tokenBuffer` and `authTokenBuffer` were compared before calling `crypto.timingSafeEqual`.
+**Learning:** Comparing lengths before `crypto.timingSafeEqual` creates a short-circuit fast path. An attacker can guess the length of the expected token because invalid lengths return faster than valid ones.
+**Prevention:** Always hash both secrets to a fixed length (e.g., using `crypto.createHash('sha256')`) before comparison to ensure true constant-time evaluation and prevent leaking the secret's length via timing differences.
diff --git a/src/cli/commands/serve.ts b/src/cli/commands/serve.ts
index 2c37293e..1a3c7cb6 100644
--- a/src/cli/commands/serve.ts
+++ b/src/cli/commands/serve.ts
@@ -349,10 +349,9 @@ export async function handleServeCommand(_options: unknown, command: Command) {
             const tokenBuffer = Buffer.from(token);
             for (const authToken of authTokens) {
               const authTokenBuffer = Buffer.from(authToken);
-              if (
-                tokenBuffer.length === authTokenBuffer.length &&
-                crypto.timingSafeEqual(tokenBuffer, authTokenBuffer)
-              ) {
+              const hashedToken = crypto.createHash('sha256').update(tokenBuffer).digest();
+              const hashedAuthToken = crypto.createHash('sha256').update(authTokenBuffer).digest();
+              if (crypto.timingSafeEqual(hashedToken, hashedAuthToken)) {
                 isAuthenticated = true;
                 break;
               }
diff --git a/tests/integration/prompt_templates.test.ts b/tests/integration/prompt_templates.test.ts
index 21905259..f1360d78 100644
--- a/tests/integration/prompt_templates.test.ts
+++ b/tests/integration/prompt_templates.test.ts
@@ -36,7 +36,9 @@ describe('Prompt templates', () => {
 
     expect(planSystem).toContain('You are SalmonLoop.');
     expect(patchSystem).toContain('You are PATCH, a phase-native diff compiler.');
-    expect(autopilotSystem).toContain('You are a senior software engineer running in "autopilot" mode.');
+    expect(autopilotSystem).toContain(
+      'You are a senior software engineer running in "autopilot" mode.',
+    );
     expect(answerSystem).toContain('You are a coding assistant in "answer" mode.');
     expect(researchSystem).toContain('You are a research assistant.');
   });