Weak Password Hashing
What it is
Password creation or verification code appears to use a fast general-purpose hash instead of a password storage KDF.
This usually appears when generated code proves that a feature works but does not leave enough evidence that the launch boundary was checked.
How to fix it
Use Argon2id where available, or bcrypt/scrypt with reviewed parameters, and migrate existing weak password hashes safely.
- 1Switch password storage to Argon2id, or bcrypt/scrypt with reviewed parameters.
- 2Migrate existing weak hashes safely (rehash on next successful login).
- 3Add tests that fail if a fast general-purpose hash reappears in auth code.
How VibeAudit checks for this
VibeAudit checks this with scoped evidence from supported structural checks, external observations, and authorized probes where available. The free tier may show the surface name only, without private evidence or remediation details. Metadata-only surface maps do not create missing-control findings. Unsupported private repositories, authenticated behavior, destructive workflows, account configuration, and business logic remain unverified unless the scan includes matching local, imported, or authorized runtime evidence.
Related failure modes
Check your public launch surface and keep unsupported scope visible.
Run Quick Scan