> vulnerable to length extension I think this is only relevant if you're using a hash as a MAC, in which case you should be using HMAC-SHA256 instead which is

> vulnerable to length extension I think this is only relevant if you're using a hash as a MAC, in which case you should be using HMAC-SHA256 instead which is not vulnerable to length extension attacks