// [CRUCIBLE-SEED]
// category: insecure_crypto
// severity: high
// language: csharp
// expected: MD5 used for password hashing via MD5.Create()

using System.Security.Cryptography;
using System.Text;

namespace App.Security
{
    public class PasswordHasher
    {
        // Vulnerable: MD5 is cryptographically broken and unsalted
        public static string HashPassword(string password)
        {
            using var md5  = MD5.Create();
            byte[] hash    = md5.ComputeHash(Encoding.UTF8.GetBytes(password));
            return BitConverter.ToString(hash).Replace("-", "").ToLower();
        }

        public static bool Verify(string password, string storedHash)
            => HashPassword(password) == storedHash;
    }
}