[Security] Fix 6 vulnerabilities: Plaintext Passwords, Hardcoded JWT, Default Accounts, Missing SECRET_KEY (CWE-256, CWE-798, CWE-1392, CWE-532)

[saaa99999999]

Security Issues Fixed

1. Plaintext Password Storage (CWE-312) — Critical

All user passwords were stored as plaintext in the SQLite database. The User model defined passwords as a plain string column with no hashing:

:

Login compared raw password strings directly in the SQL query:

Password reset read and wrote plaintext passwords:

Anyone with database access (SQL injection, backup leak, insider threat) can read every user password in cleartext.

Fix: Added bcrypt password hashing via set_password()/check_password() methods on the User model:

:

Updated Register handler:

Updated Login handler:

Updated ResetPassword handler:

Also added to .

2. Hardcoded JWT Secrets (CWE-798) — Critical

had hardcoded JWT signing keys:

Anyone who knows these strings can forge valid tokens for any user, including admin and super_admin roles.

Fix: Read secrets from environment variables:

Other Fixes

• Removed password from User.repr to prevent plaintext password exposure in logs
• Removed automatic creation of default users (super_admin, admin, test_user) with hardcoded credentials
• Changed FLASK_DEBUG from hardcoded True to read from environment variable

[saaa99999999]

CVE Request — Action Needed from Maintainer

This PR fixes security vulnerabilities. To assign a CVE number:

GitHub only issues CVEs from the official upstream repository, not from forks.

Please:

1. Go to this repo → Security → Advisories → New draft security advisory
2. Add @saaa99999999 as a collaborator
3. I will populate the full vulnerability details (CVSS, CWE, data flow, PoC) and submit the CVE request

If you prefer, I can submit the CVE via MITRE (cveform.mitre.org) instead — just let me know.

Thank you for reviewing this PR!