It's maybe also worth pointing out that if the same salt is used for each password, then an attacker who can leak the hashes after creating their own account (w

It's maybe also worth pointing out that if the same salt is used for each password, then an attacker who can leak the hashes after creating their own account (with a known password) can try brute-forcing the salt. If the attacker hasn't seen the code, they won't know whether the salt is prepended, or appended, or both to the password (or if there are two salts), but the amount of computation needed to try all possible salts is roughly equivalent to the amount needed to crack a single well-chosen (unsalted) password.