diff --git a/backend/middleware/session.go b/backend/middleware/session.go
index 8a695fc0..62062aa9 100644
--- a/backend/middleware/session.go
+++ b/backend/middleware/session.go
@@ -67,7 +67,10 @@ func handleAPISession(
 		}
 		incomingHash := sha256.Sum256([]byte(headerAPIKey))
 		found := false
-		// Must check ALL keys in constant time
+		// compare each key using constant-time comparison to avoid hash timing leaks.
+		// early exit via break is acceptable here because the key slice is derived from
+		// a go map, which randomizes iteration order on every call — an attacker cannot
+		// correlate iteration count to a stable key position across requests.
 		var rApiUser *model.APIUser
 		for _, apiUser := range apiUsers {
 			if subtle.ConstantTimeCompare(incomingHash[:], apiUser.APIKeyHash[:]) == 1 {