reminder that the bcrypt hash function ignores input above a certain length! so if you do bcrypt(username || password) for some reason, a sufficiently long username will make it accept any password. to fix this you can sha256 the input first. https://bird.makeup/@kmcquade3/1852475962715246869
See Tweet