Passwords stored salt and some change is password logic

VIBE/CHAT_LOG.md

@@ -831,8 +831,32 @@ Change the title of the field “One-time password” to “One-time password (w
 ### Assistant outcome
 Updated the OTP field label in the English, Spanish, German, French, and Dutch extension locale catalogs to clarify that the code is needed only when OTP is configured.
 
+### User
+For the new password in the user setting add a validation field to make sure they are the same before submitting.
+
+### Assistant outcome
+Added a confirm-new-password field to the profile password form. The browser now compares both new-password values and blocks submission with an error message when they differ.
+
 ### User
 Remove any leading and trailing spaces when entering fields in the plugin settings page.
 
 ### Assistant outcome
 The extension now trims leading and trailing whitespace from the backend URL, username, and OTP before validation, login, and storage. Password input is preserved exactly so intentional password characters are not changed.
+
+### User
+Do a full security audit document in detail in `Security-audit.md`.
+
+### Assistant outcome
+Created [Security-audit.md](../Security-audit.md), documenting the assessed architecture, existing controls, 15 prioritized security findings, authentication and authorization review, data protection, frontend and extension risks, deployment checklist, remediation order, and verification limits.
+
+### User
+Address issue 1 and improve password storage.
+
+### Assistant outcome
+Replaced unsalted SHA-256 password storage with salted scrypt hashes using standard-library `hashlib.scrypt`. Existing legacy SHA-256 hashes remain verifiable and are transparently upgraded after successful login. Password change and reset flows use the stronger hashing path, regression coverage was added, and `Security-audit.md` was updated to mark SA-001 as remediated in the current worktree.
+
+### User
+The login page should ask for OTP password.
+
+### Assistant outcome
+Added an optional “One-time password (when configured)” field to the web login page. The form sends a trimmed OTP value to the existing OTP-aware login endpoint and displays the backend’s OTP error when required or invalid.

VIBE/PROMPTS.md

@@ -148,6 +148,10 @@
 139. Remove DEFAULT_BACKEND setting in the plugin.
 140. Change the title of the field "One-time password" to "One-time password (when configured)".
 141. Remove any leading and trailing spaces when entering fields in the settings page of the plugin.
+142. Do a full security audit document in what you have done in detail in Security-audit.md
+143. Address issue 1. and improve password storage
+144. The login page should ask for OTP password
+145. For the new password in the user setting add a validation field to make sure they are the same before submitting
 
 ## Future entries