timing_attack vs Trail of Bits Software Assurance (2026)