Update: 2026-05-03 20:56:55

app/core/Security.php

@@ -28,4 +28,15 @@ final class Security
     {
         return bin2hex(random_bytes($length / 2));
     }
+
+    public static function sign(string $data, string $secret): string
+    {
+        return hash_hmac('sha256', $data, $secret);
+    }
+
+    public static function verifySignature(string $data, string $signature, string $secret): bool
+    {
+        $expected = self::sign($data, $secret);
+        return hash_equals($expected, $signature);
+    }
 }