Source code
Security & compliance
Weak password hash (MD5/SHA/low-bcrypt)
Part of the AI-generated code risks check · fix arrives as a pull request
What it is
Passwords are hashed with MD5, SHA-1, SHA-256, or bcrypt at a work factor low enough to be brute-forced cheaply.
Why it matters
Fast hashes are the problem — they are designed to be quick, which is exactly what an attacker with the dump wants. A SHA-256 password table falls to commodity GPUs in hours, so a database leak becomes a credential leak.
How to fix it
Use bcrypt at cost 12 or above, or argon2id. Rehash each password on next successful login so the migration completes without forcing a reset, and keep the old verifier around until the last user has rotated.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.