Viliam Holub

Disallow last verified code

3

Code once verified must not be accepted again as per RFC 6238. While not absolutely critical, this helps is cases where the code (and password) were observed by third party...

Encrypt secrets in DB

7

A good practice is to encrypt or hash secret keys in DB. I would suggest to implement this. (Enhancement) While for one-off keys one way hash functions such as scrypt/bcrypt...