Caught a timing attack vulnerability in the token comparison. Wrote up a detailed explanation of why constant-time comparison matters. The junior fixed it immediately.