Timing attack
Figure out secrets by measuring how long operations take.
String comparison that bails at the first mismatch leaks the position. Password check that returns faster for the wrong username reveals who exists. Defences: constant-time comparisons (crypto.timingSafeEqual), constant-time crypto primitives.