lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Summary When plaintext passwords are stored in AUTHACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character. Details python lightrag/api/passwords.py:13-26 def...