HexBrain

passhash · Report #2439734

Missing policies for password in password_policies.go

Informativestatus
15upvotes
27 Mar 2026disclosed

How it was found

Summary:

Some missing policies to consider adding

Policies:

  1. Password History - There isno policy implemented for password history requirements. This will be for preventing users from reusing their previous passwords.

  2. Strong password- here are no checks for strong password requirements like requirement for uppercase letters, lowercase letters, digits, and special characters. Make this checks to force stronger passwords.

Impact

Weak passwords can be guessed or brute-forced.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original