I security-audited my own AI gateway and added WASM plugin support. Here's what I found.

I ' ve been building AegisFlow , an open - source AI gateway in Go . It sits between your apps and LLM providers ( OpenAI , Anthropic , Ollama , etc . ) and handles routing , security , rate limiting , and observability . Yesterday I sat down and did a proper security audit of the whole thing . Found more issues than I ' d like to admit . The security stuff Timing attacks on API key validation . The tenant key lookup was using plain string comparison . An attacker could measure response times to progressively guess keys character by character . Switched to SHA - 256 hashing both sides and comparing with subtle . ConstantTimeCompare . Also iterates all tenants on every check so there ' s no early - exit timing leak . inputHash := sha256 . Sum256 ([] byte ( apiKey )) var match * TenantConfig for i := range c . Tenants { for _ , key := range c . Tenants [ i ] . APIKeys { keyHash := sha256 . Sum256 ([] byte ( key )) if subtle . ConstantTimeCompare ( inputHash [ : ], keyHash [ : ]) == 1 { m