Those two unhandled errors in the Rainbow bcrypt hashes are a big security bug: a constant (unnoticed) error would allow ANY password to be accepted! This is si

Those two unhandled errors in the Rainbow bcrypt hashes are a big security bug: a constant (unnoticed) error would allow ANY password to be accepted! This is similar to an old Linux bug where there was an equal instead of a comparison sign, allowing for any password. Use either a well tested library if you want a Promise-based bcrypt function or make sure you test yours. However it still seems like a good starting point and if you follow those steps it's better than nothing.