BUG: [Audit] Backend: Inconsistent password hashing and missing DB rollback logic

[VaibhavKhokha]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

During a preliminary technical audit of the PictoPy backend for GSoC 2026, I identified two logical issues that could affect system stability:

Password Consistency: Empty strings are currently being hashed in some paths instead of being treated as None.

Transaction Integrity: The metadata write flow lacks a rollback() mechanism, which could lead to partial data writes if an execution fails.

I have already researched and prepared a fix for these issues to ensure production-grade reliability.

Note: I previously opened PR #1242 with the fixes. I am opening this issue now to follow the proper contribution workflow as requested by the mentor.

MyPy Scan Before Fixes (54 Errors):

MyPy Scan After Fixes (49 Errors):

Record

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Thanks for opening this issue! The maintainers will review it shortly. Till then, do not open any PR. This is a strict rule we like to follow around here :)

[amishikaushal]

hiii ... i would like to work on this issue?

[VaibhavKhokha]

Hello maintainers, I am following up on this issue to provide an update. I have further refined the implementation for both the transaction rollback mechanism and the password hashing consistency to ensure they fully align with the project's stability requirements.
I Would Like to Raise a PR for the Fix..
Please Assign this to Me.

[JITENDRAGAHERWAR03]

Hello 👋
I am interested in working on this issue. I have basic knowledge of Python and I’m eager to learn and contribute. I will try to provide a clean and well-documented solution.
Please assign this issue to me if possible.
Thank you 😊

[Riddhi8077]

Hi @VaibhavKhokha , @SIDDHANTCOOKIE , @AllMaintainers ,

This looks like an important audit finding, especially around password handling and transaction safety. I went through the description and it makes sense how these cases could impact reliability.

I’d be interested in contributing here, but since you’ve already worked on a fix and opened a PR earlier, I just wanted to check, is this issue still open for contribution or should I look into something else?

Happy to help if needed. Thanks!