Patched code sample

import pickle
import hmac
import hashlib
import aiofiles
import aiofiles.os
from pathlib import Path

# In a real application, this key must be securely generated and managed,
# for example, by loading it from a secure vault or environment variable.
SECRET_KEY = b'replace-with-a-securely-generated-and-managed-secret-key'

class AsyncDiskCache:
    def __init__(self, cache_dir: str):
        self.cache_dir = Path(cache_dir)
        self.cache_dir.mkdir(parents=True, exist_ok=True)
        self.secret_key = SECRET_KEY
        self.signature_length = hashlib.sha256().digest_size

    def _get_path(self, key: str) -> Path:
        hashed_key = hashlib.sha256(key.encode()).hexdigest()
        return self.cache_dir / f"{hashed_key}.cache"

    async def set(self, key: str, value: object):
        """Serializes, signs, and writes data to the cache."""
        path = self._get_path(key)
        pickled_data = pickle.dumps(value)
        
        signature = hmac.new(
            self.secret_key, pickled_data, hashlib.sha256
        ).digest()

        async with aiofiles.open(path, "wb") as f:
            await f.write(signature + pickled_data)

    async def get(self, key: str) -> object | None:
        """
        Reads, verifies the signature, and deserializes a cached object.
        This fixed method prevents loading tampered/malicious data.
        """
        path = self._get_path(key)
        if not await aiofiles.os.path.exists(path):
            return None

        async with aiofiles.open(path, "rb") as f:
            payload = await f.read()

        if len(payload) < self.signature_length:
            return None 

        expected_signature = payload[:self.signature_length]
        pickled_data = payload[self.signature_length:]

        actual_signature = hmac.new(
            self.secret_key, pickled_data, hashlib.sha256
        ).digest()

        if not hmac.compare_digest(expected_signature, actual_signature):
            # Signature mismatch indicates data tampering. Do not deserialize.
            return None

        # Only deserialize if the integrity check passes.
        return pickle.loads(pickled_data)