removed excess comments

src/server/password.ts

@@ -1,10 +1,5 @@
 import * as bcrypt from "bcrypt";
 
-/**
- * Dummy hash for timing attack prevention
- * This is a pre-computed bcrypt hash that will be used when a user doesn't exist
- * to maintain constant-time behavior
- */
 const DUMMY_HASH =
   "$2b$10$YxVvS6L6HhS1pVBP6nZK0.9r0xwN8xvvzX7GwL5xvKJ6xvS6L6HhS1";
 
@@ -25,16 +20,13 @@ export async function checkPassword(
 
 /**
  * Check password with timing attack protection
- * Always runs bcrypt comparison even if user doesn't exist
  */
 export async function checkPasswordSafe(
   password: string,
   hash: string | null | undefined
 ): Promise<boolean> {
-  // If no hash provided, use dummy hash to maintain constant timing
   const hashToCompare = hash || DUMMY_HASH;
   const match = await bcrypt.compare(password, hashToCompare);
 
-  // Return false if no real hash was provided
   return hash ? match : false;
 }