Rubric: 20 points
| Evidence | Points | Full-credit standard |
|---|---|---|
| Baseline investigation | 4 | Correct/wrong login results, two equal original records and successful decoding; explains unsafe storage despite working login. |
| Repair | 4 | Uses supplied hashPassword for storage and verifyPassword for checking; preserves the surrounding app and explains both choices. |
| Repaired evidence | 4 | Correct/wrong results, two different hash records for the same password, null decoding result, and successful correct check after re-registration. |
| Automated verification | 3 | Complete seven-check passing output from the student's repaired app; distinguishes checks from browser state. |
| Reasoning | 5 | Distinguishes encoding/encryption/hashing (1), explains salt (1), explains reuse of stored salt for verification (1), recognizes guessing remains possible (1), and identifies one further real-system protection (1). |
Award partial credit for correct evidence and reasoning even if setup or repair is incomplete. Screenshots and copied text are equally acceptable. Do not require exact salt/hash values or a particular operating system. Record observation-only work separately; it is not evidence of an implemented repair.
Discussion-only topics such as migration internals, scrypt tuning, and MFA implementation are not graded. The guided repair is intentionally small; explanations and before/after evidence are essential.