I security-audited my own AI gateway and added WASM plugin support. Here's what I found.

I've been building AegisFlow, an open-source AI gateway in Go. It sits between your apps and LLM providers (OpenAI, Anthropic, Ollama, etc.) and handles routing, security, rate limiting, and observability. Yesterday I sat down and did a proper security audit of the whole thing. Found more issues than I'd like to admit. The security stuff Timing attacks on API key validation. The tenant key lookup was using plain string comparison. An attacker could measure response times to progressively guess keys character by character. Switched to SHA-256 hashing both sides and comparing with subtle.ConstantTimeCompare. Also iterates all tenants on every check so there's no early-exit timing leak. inputHash := sha256.Sum256([]byte(apiKey)) var match *TenantConfig for i := range c.Tenants { for _, key := range c.Tenants[i].APIKeys { keyHash := sha256.Sum256([]byte(key)) if subtle.ConstantTimeCompare(inputHash[:], keyHash[:]) == 1 { match = &c.Tenants[i] } } } Admin panel was open by default. If y