Implement secure password handling and database security

[manasdutta04]

Problem Statement

The current implementation has several security vulnerabilities:

Weak Password Encryption: Uses basic character manipulation instead of proper cryptographic hashing Hardcoded Database Credentials: Database configuration is stored directly in source code SQL Injection Vulnerability: Direct string formatting in SQL queries No Session Management: Missing secure session handling

Proposed Solution

✅ Tasks to Complete [ ] Replace custom encryption with proper password hashing

• Implement bcrypt or argon2 for password hashing
• Add salt generation for each password
• Update login verification logic

[ ] Implement environment variables for database configuration

• Create .env file support
• Move all sensitive config to environment variables
• Add .env.example template

[ ] Add input validation and SQL injection prevention

• Replace string formatting with parameterized queries
• Add input sanitization functions
• Implement data validation schemas

[ ] Implement secure session management

• Add session tokens for logged-in users
• Implement session timeout
• Add secure logout functionality

Please assign me @multiverseweb

[github-actions[bot]]

👋 Thank you for raising an issue! We appreciate your effort in helping us improve. A maintainer from Dataverse will review it shortly. Stay tuned!