I really dig the login system! I thought it should be vulnerable to 1. find hash on victim's profile, 2. login using the hash + username But it seems the ha

I really dig the login system! I thought it should be vulnerable to 1. find hash on victim's profile, 2. login using the hash + username But it seems the hash is never actually submitted to the server, neither through the login form nor later on by cookie. That is good news! The implied hurdle is that you'll need to update the hash on each login.