Hashing and signing functions assume UTF‑8 but do not enforce encoding. **Risk:** Same logical payload can hash to different digests across encodings. **Proposed fix:** Force UTF‑8 encoding or raise on non‑UTF‑8 input for all user‑supplied strings.
Hashing and signing functions assume UTF‑8 but do not enforce encoding.
Risk: Same logical payload can hash to different digests across encodings.
Proposed fix: Force UTF‑8 encoding or raise on non‑UTF‑8 input for all user‑supplied strings.