diff --git a/sentinel/web/app.py b/sentinel/web/app.py
index 7a0fdfc..743dce6 100644
--- a/sentinel/web/app.py
+++ b/sentinel/web/app.py
@@ -143,6 +143,7 @@ async def internal_snapshot(nonce: str, request: Request) -> Response:
         """Single-use JPEG endpoint for the Obico ML API URL-fetch flow."""
         if internal_token is not None:
             t = request.query_params.get("t") or ""
+            # Use constant-time comparison to prevent timing side-channel attack
             if not t or not hmac.compare_digest(t, internal_token):
                 raise HTTPException(status_code=403, detail="Forbidden: Invalid internal token")