fix(webhooks): compare signatures in constant time

[cbetta]

Compares webhook signatures in constant time.

- if(!signatures.contains(expectedSignature)) {
+ boolean matched = signatures.stream()
+     .anyMatch(signature -> MessageDigest.isEqual(expected, signature.getBytes(UTF_8)));
+ if(!matched) {

The old comparison stops at the first character that differs, so how long a rejection takes shows how much of a guessed signature was right. Rotation still works: any one of the comma-separated signatures can match. The expected signature goes first because isEqual's time follows its first argument's length.

🤖 Generated with Claude Code

[github-actions]

Endpoint-reach coverage

120 / 120 operations reached by a real HTTP request (100%).

Every operation in the SDK was reached. 🎉

[Copilot]

Copilot review overview

🟡 Changes recommended

The timing-safe comparison operands must be reversed so execution time depends on the fixed expected digest length.

Review effort: Balanced
Findings: 1

Open (1)

• Use fixed-length digest as first comparison argument · New

What changed in this PR

Updates webhook signature verification to use timing-safe comparisons while preserving signature rotation support.

Changes:

• Uses MessageDigest.isEqual for signature checks.
• Adds valid-position and near-match tests.

File	Description
src/​main/​java/​com/​gr4vy/​sdk/​Webhooks.java	Adds timing-safe signature comparison.
src/​test/​java/​com/​gr4vy/​sdk/​WebhooksTest.java	Adds signature verification coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The security fix is correctly implemented and adequately covered by focused tests.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Use fixed-length digest as first comparison argument