article
Bcrypt came off the API keys, then a day went to finding the paths I missed
Wrong API keys made my auth service run a slow bcrypt check per candidate row, which guarded nothing for long random keys. I moved them to SHA-256 with constant-time compares, missed several paths on the first pass, and left a slow legacy branch and an untested format check behind.
Read more 4m read