I feel like this is ultra vires? It's a common sentiment now that just hashing passwords is terrible, but we did this at every startup I worked at previously an

I feel like this is ultra vires? It's a common sentiment now that just hashing passwords is terrible, but we did this at every startup I worked at previously and it was fine. Is it really an issue? For an early-stage startup, almost nobody sees the app anyways lol--we'd all be lucky if we were popular enough to hack For my current startup, my cofounder, who is the CTO, insisted we use auth0, so we do, but it's a pain. It's such overhead. Sometimes it's buggy. There is a lot of stuff we have done and (are trying to do) that would have been so much faster to build if we had just done it my way. I wonder if I am very naive or cavalier about the security risks.