Lucas Berger 85b01b5c26 feat(19-01): implement hashPassword/verifyPassword with scrypt + timingSafeEqual ...

- node:crypto scrypt (N=16384, r=8, p=1, 32-byte output) — zero new dependencies (D-08)
- 16-byte random salt per hash; PHC-encoded format: scrypt$N$r$p$salt_b64url$hash_b64url
- timingSafeEqual for constant-time comparison (prevents timing oracle attacks, T-19-01)
- verifyPassword returns false on any error (never throws); passwords never logged
- All 5 unit tests pass (round-trip, wrong-pw, unique-salt, malformed-hash, PHC-shape)

2026-06-17 16:12:59 -04:00

..

api

feat(19-01): implement hashPassword/verifyPassword with scrypt + timingSafeEqual

2026-06-17 16:12:59 -04:00

pwa

fix(12): unblock CI security + harness jobs

2026-06-16 18:24:10 -04:00