How to use Copilot to protect signup passwords
Copilot proposed guards for verified signup passwords, deletion confirmation and malformed hashes; the draft retained reset-token risks for human review.
github.com
Original prompt
Shared by the source author. See source notes for context.
Please review this repository and open one pull request with findings and fixes.
Reach people exploring AI agents
See placements →What happened
An unmerged draft preserves verified-account password hashes, requires deletion confirmation and rejects malformed hashes, with tests and reset-token limitations documented.
Reported by Aswinmcw with Copilot — GitHubHow the agent did it
- Copilot traced signup behavior and prevented existing verified accounts from receiving a replacement password hash.
- It added regression cases for verified signup, deletion confirmation and malformed stored hashes.
- It documented reset-token reuse as report-only and requested owner review of the draft commits.
Where a person stepped in
Aswinmcw supplied the audit scope and instructed the agent to report risky changes; the draft awaited human review and was not merged at verification.
Aswinmcw asked Copilot to review an authentication repository, make safe fixes, and leave riskier behavior changes as findings. The resulting draft uncovered a signup path that updated the password hash of an existing account even when the email was already verified.
Copilot restricted that update to unverified accounts. A focused regression creates a verified user, submits another signup request for the same email, and confirms that the original hash is retained. The draft also makes the account-deletion confirmation mandatory and handles malformed stored password hashes by returning failure instead of throwing.
The work did not silently claim complete authentication security. Reusable password-reset tokens were left as a documented finding because correcting them would require persistence or versioning and session invalidation. Mutable publishing dependencies also remained under discussion.
The agent produced separate commits and requested the owner’s review. At verification, the pull request was still a draft and had no human approval. The concrete outcome is a reviewable patch with regression cases and explicit unresolved risks, rather than an accepted or deployed authentication repair. The human checkpoint was the requested review.
Prompt
Original prompt
Source: GitHub · Aswinmcw with Copilot
Frequently asked questions
What did the signup regression check?
Another signup request must not replace a verified user’s password hash.
Were password-reset tokens fixed?
No. Reuse until expiry remained a reported finding.
Was the patch deployed?
The verified record was an open draft, without human approval or merge.
More details
About this account
Copilot traced signup behavior and prevented existing verified accounts from receiving a replacement password hash. It added regression cases for verified signup, deletion confirmation and malformed stored hashes.
Original PR, public API and changed authentication/tests files opened. Source prompt formatting was normalized to plain text without changing its words. This is a pending proposal; no accepted fix or deployment is claimed. Original prompt excerpt.
Credit: Aswinmcw with Copilot — GitHub
Source published 12 Oct 2026
Source checked 14 Oct 2026
Tools and topics
GitHub Copilot · TypeScript · Cloudflare D1 · Node.js tests
authentication · account integrity · draft remediation
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.