[
  {
    "id": "TIME001",
    "pattern": "token\\s*==\\s*validToken|return\\s+token\\s*==\\s*",
    "flags": "",
    "category": "timing_attack",
    "description": "Timing attack",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "medium"
  },
  {
    "id": "TIME002",
    "pattern": "bytes\\.Equal\\s*\\(\\s*expected\\s*,\\s*received\\s*\\)",
    "flags": "i",
    "category": "timing_attack",
    "description": "Go timing attack",
    "language": [
      "go"
    ],
    "severity": "medium"
  },
  {
    "id": "TIME003",
    "pattern": "token\\s*!=\\s*validAPIToken\\b",
    "flags": "",
    "category": "timing_attack",
    "description": "Go timing attack",
    "language": [
      "go"
    ],
    "severity": "medium"
  },
  {
    "id": "TIME004",
    "pattern": "\\w*[Tt]oken\\s*!=\\s*\\w*[Tt]oken\\b",
    "flags": "",
    "category": "timing_attack",
    "description": "Go: timing attack via != comparison of tokens; open redirect via decoded state",
    "language": [
      "go"
    ],
    "severity": "medium"
  }
]