Passwords and account security

Passwords are hashed with bcrypt before they're ever stored — QuoteASAP's own database never holds a plain-text password, and a failed sign-in attempt doesn't reveal whether the email or the password was wrong (so accounts can't be enumerated by trial and error).

Being straightforward about what's not built yet: there's no self-service "forgot password" reset flow, no email verification step, and no two-factor authentication. If you're genuinely locked out during early access, this needs to be resolved manually rather than through a self-service flow — those are the next pieces of account security work.