Code passes two arguments to Crypt::hashBase64()

The module is using the following code.

function honeypot_get_signed_timestamp($time) {
  $private_key = Drupal::service('private_key')->get();
  return $time . '|' . Crypt::hashBase64($time, $private_key);
}

Crypt::hashBase64() accepts just an argument: the data for which you need the hash. What requires two arguments is Crypt::hmacBase64().

The result is that the module is giving out in clear the hash of the timestamp together the timestamp. If spammers understand this, it would easier for them to forge a value.

The code should use Crypt::hmacBase64().