fix: use constant-time comparison for API key

api/main.py

@@ -1,3 +1,4 @@
+import hmac
 import os
 from fastapi import FastAPI, Depends, HTTPException, Security
 from fastapi.security.api_key import APIKeyHeader
@@ -18,7 +19,7 @@ def get_api_key(api_key_header: str = Security(api_key_header)):
         # If no key is configured, deny all requests for safety
         raise HTTPException(status_code=500, detail="API_KEY not configured on server")
 
-    if api_key_header == expected_api_key:
+    if hmac.compare_digest(api_key_header or "", expected_api_key):
         return api_key_header
     raise HTTPException(status_code=401, detail="Invalid or missing API Key")