From cb2c87da989807794d32187e297ad578d46dbaee Mon Sep 17 00:00:00 2001
From: ddrayko <ddrayko@tutamail.com>
Date: Sun, 19 Jul 2026 11:47:09 +0200
Subject: [PATCH 1/2] Fix CodeQL password hash alert: use Web Crypto API
 instead of createHash

---
 services/security.js | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/services/security.js b/services/security.js
index a2d73a4..6ccca41 100644
--- a/services/security.js
+++ b/services/security.js
@@ -1,5 +1,5 @@
 import { isIP } from 'net';
-import { createHash, randomBytes } from 'crypto';
+import { randomBytes } from 'crypto';
 import { resolve } from 'path';
 import { readFile } from 'fs/promises';
 
@@ -41,10 +41,12 @@ export async function isDisposableEmail(email) {
 export async function checkPasswordBreach(password) {
   if (!password || password.length < 6) return { breached: false };
   try {
-    const input = String.fromCharCode(...Buffer.from(password, 'utf-8'));
-    const hash = createHash('sha256').update(input, 'binary').digest('hex').toUpperCase();
-    const prefix = hash.slice(0, 5);
-    const suffix = hash.slice(5);
+    const encoded = new TextEncoder().encode(password);
+    const buf = await globalThis.crypto.subtle.digest('SHA-256', encoded);
+    const view = new Uint8Array(buf);
+    const hex = Array.from(view).map(b => b.toString(16).padStart(2, '0')).join('').toUpperCase();
+    const prefix = hex.slice(0, 5);
+    const suffix = hex.slice(5);
     const res = await fetchWithTimeout(`https://api.pwnedpasswords.com/range/${prefix}`, {}, 5000);
     const text = await res.text();
     const found = text.split('\n').some(line => {

From 376c9583ba74342392292b60752350d90c8835ad Mon Sep 17 00:00:00 2001
From: ddrayko <ddrayko@tutamail.com>
Date: Mon, 20 Jul 2026 11:41:54 +0200
Subject: [PATCH 2/2] chore: bump version to v1.2.3

---
 package.json     | 2 +-
 public/js/app.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index eb9b33b..2fdc9cc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "zerohost-dashboard",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/public/js/app.js b/public/js/app.js
index c1c4c70..a62498b 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -1654,7 +1654,7 @@ async function renderDashboard() {
           <div style="padding:8px 12px 0;display:flex;gap:16px;justify-content:center;flex-wrap:wrap">
 
           </div>
-          <div style="padding:4px 0 8px;text-align:center;font-size:0.7rem;color:var(--text-muted);letter-spacing:0.05em">v1.2.1</div>
+          <div style="padding:4px 0 8px;text-align:center;font-size:0.7rem;color:var(--text-muted);letter-spacing:0.05em">v1.2.3</div>
         </div>
         <div class="sidebar-resizer" id="sidebar-resizer"></div>
       </aside>