Security
Bug Report
Audit found our "encrypted" passwords were Base64: migrating to Argon2id without a mass reset
A security review of a legacy customer portal found the password column was only Base64-encoded. Here is how we confirmed it, why encoding is not encryption, and how we moved 180,000 accounts to Argon2id with rehash-on-login and a targeted reset.