Password hashing

Verifies

Every password is hashed with a slow, salted algorithm at adequate cost, and never with MD5, SHA-1 or a plain SHA-2 digest, nor stored in clear.

Inputs

Non-test code files of the checkout (JavaScript, TypeScript, Python, PHP). Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.

Decision rule

Not applicable when no non-test file handles a password, or when passwords are mentioned but neither hashed nor persisted in the checkout (external identity provider). FAIL (HIGH) when a fast digest (createHash md5/sha1/sha256/sha512, hashlib.*, md5()/sha1()/hash('sha256'), CryptoJS, MessageDigest) is applied to a password-named value, or when a password from the request is persisted and no slow hash (bcrypt, argon2, scrypt, PBKDF2, password_hash, Hash::make, make_password/set_password, passlib, libsodium pwhash) nor framework hashing hook exists anywhere in the checkout. Weak parameters are MEDIUM (bcrypt cost below 10, PBKDF2 below 100000 iterations, argon2 memory below 15 MiB, scrypt N below 16384, a weak Django first hasher or Laravel driver) and block only inside Extended suites. PASS when a slow hash is in use and no rule fired.

Type

deterministic

1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative; every model call stays under the engine prompt cap (spec.promptMaxChars = AUDITOR_AI_PROMPT_MAX_CHARS): assess mode sends the candidate set in parts and aggregates the verdicts (a HIGH in any part is a FAIL, an unsatisfied part is a FAIL).)

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.