HIGH: - H1: Fix admin token timing attack using constant-time comparison - H2: Fix HMAC length mismatch DoS with pre-check before timingSafeEqual MEDIUM: - M1: Remove weak PRNG fallback, require crypto.getRandomValues - M2: Move tokens from URL query params to fragments for security - M3: Add IP-based rate limiting middleware for all gateway routes - M4: Sanitize error messages to prevent information disclosure - M5: Add OAuth state validation with size/depth limits New files: - gateway/src/middleware/rateLimit.ts: IP-based rate limiting - gateway/src/utils/errors.ts: Safe error response handling - ts/src/validation.ts: Input validation utilities