- Replace plaintext password comparison with bcrypt verification - Hash passwords before database storage in registration - Validate bcrypt hashes during login to reject legacy plaintext - Update password change and reset flows with proper hashing - Add legacy password detection for security enforcement