This issue does NOT have a high severity as Austeritas hashes the password with bcrypt later on in the process, so for an attacker, it's not a highly applicable vulnerability.
Still, this extra-step of inbetween hashing to SHA-256 is unnecessary and causes lots of false positives on the code scanning CI/CD pipe. Removing it may slightly increase security + remove the alerts.
Is your feature request related to a problem? Please describe.
A lot of people are cheating often. Banning known cheaters on every Austeritas instance would be effective.
Describe the solution you'd like
Austeritas could warn the server owner about known usernames and immediately ban players on the list of known people.
Is your feature request related to a problem? Please describe.
Using JSON files is okay for constants and rarely used content, but not for dynamic, fastly-changing data.
Describe the solution you'd like
Migrating to SQLite would fix this problem.
Additional context
ANY potential injection attacks have to be mitigated before pushing to production. CodeQL analysis must be read through.
Is your feature request related to a problem? Please describe.
The maintenance of a codebase not using a src directory can get very challenging over time as non-code files are getting mixed up with code.
Describe the solution you'd like
By moving all necessary files used by the code into a folder called src, app, austeritas or similar, more conciseness can be achieved.
Describe alternatives you've considered
An alternative would be to move non-code files in their own directory, but this is very uncommon and does not work as well.