How to use Copilot to protect signup passwords
Copilot proposed guards for verified signup passwords, deletion confirmation and malformed hashes; the draft retained reset-token risks for human review.
github.com
Original prompt
Shared by the source author. See source notes for context.
Please review this repository and open one pull request with findings and fixes.
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source author
- Aswinmcw with Copilot
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- An unmerged draft preserves verified-account password hashes, requires deletion confirmation and rejects malformed hashes, with tests and reset-token limitations documented.
- Human involvement
- Aswinmcw supplied the audit scope and instructed the agent to report risky changes; the draft awaited human review and was not merged at verification.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- Copilot traced signup behavior and prevented existing verified accounts from receiving a replacement password hash.
- It added regression cases for verified signup, deletion confirmation and malformed stored hashes.
- It documented reset-token reuse as report-only and requested owner review of the draft commits.
Aswinmcw asked Copilot to review an authentication repository, make safe fixes, and leave riskier behavior changes as findings. The resulting draft uncovered a signup path that updated the password hash of an existing account even when the email was already verified.
Copilot restricted that update to unverified accounts. A focused regression creates a verified user, submits another signup request for the same email, and confirms that the original hash is retained. The draft also makes the account-deletion confirmation mandatory and handles malformed stored password hashes by returning failure instead of throwing.
The work did not silently claim complete authentication security. Reusable password-reset tokens were left as a documented finding because correcting them would require persistence or versioning and session invalidation. Mutable publishing dependencies also remained under discussion.
The agent produced separate commits and requested the owner’s review. At verification, the pull request was still a draft and had no human approval. The concrete outcome is a reviewable patch with regression cases and explicit unresolved risks, rather than an accepted or deployed authentication repair. The human checkpoint was the requested review.
Prompt
Original prompt
Source: GitHub · Aswinmcw with Copilot
Frequently asked questions
What did the signup regression check?
Another signup request must not replace a verified user’s password hash.
Were password-reset tokens fixed?
No. Reuse until expiry remained a reported finding.
Was the patch deployed?
The verified record was an open draft, without human approval or merge.
More details
About this account
Copilot traced signup behavior and prevented existing verified accounts from receiving a replacement password hash. It added regression cases for verified signup, deletion confirmation and malformed stored hashes.
Original PR, public API and changed authentication/tests files opened. Source prompt formatting was normalized to plain text without changing its words. This is a pending proposal; no accepted fix or deployment is claimed. Original prompt excerpt.
Credit: Aswinmcw with Copilot — GitHub
Source published
Added to Agents In Use
Source checked
Tools and topics
GitHub Copilot · TypeScript · Cloudflare D1 · Node.js tests
authentication · account integrity · draft remediation
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.