T3MP3ST public launch build

bench/cve-hunt/samples/POSTCUT-005/ground-truth.yaml

@@ -0,0 +1,28 @@
+cve: POSTCUT-005
+alias: Session HMAC verifier timing side channel (custom non-CT compare in Rust)
+cwe_primary: CWE-208
+cwe_acceptable: [CWE-208, CWE-203, CWE-385, CWE-1254, CWE-310]
+target_file: source.rs
+vuln_lines: [34, 35, 36, 37, 38, 39, 40]
+severity: high
+vuln_class: timing_attack
+exploit_pattern_regex: '(short[- ]circuit|early[- ]return|constant[- ]time|timing\s*attack|subtle::ConstantTimeEq|ct_eq|byte[- ]by[- ]byte)'
+must_mention_any:
+  - timing attack
+  - short-circuit
+  - early return
+  - constant-time
+  - byte-by-byte
+  - ConstantTimeEq
+  - subtle
+  - timing side
+  - sig[i] != expected[i]
+  - return None
+points: 30
+memorization_resistant: true
+notes: |
+  Synthetic — novel. Same anti-pattern as POSTCUT-003 but in Rust. The
+  `for i in 0..sig.len()` loop returns None on first mismatch — leaks
+  byte position via timing. Fix: use `subtle::ConstantTimeEq` or
+  `ring::constant_time::verify_slices_are_equal`.
+  Pair with POSTCUT-003 to test if the hunter generalizes across languages.