Review how my app stores user passwords. Look at the signup, login, password change, and any seed or fixture code that creates users. Confirm all of the following: passwords are hashed with bcrypt (cost factor 10 or higher) or argon2, never stored in plaintext or with fast hashes like MD5 or SHA-256, never written to logs or error messages, and never returned in any API response (including the hashed version). If you find plaintext storage or a weak hash, migrate the hashing code to bcrypt or argon2 and add a rehash-on-login path so existing users get upgraded transparently when they next sign in. Do not change the login or signup UI. Do not force a password reset for all users unless you find evidence plaintext passwords are actually stored, in which case flag it and propose a migration plan before making changes. Show me each location where passwords are handled, what you found there, and any changes you applied. End with a verification checklist: how to create a test user and confirm the stored value is a proper hash, and how to confirm the hash never appears in responses or logs.