Password strength requirements are enforced

Client-side password validation is trivially bypassed by calling the API directly with curl or any HTTP client. CWE-521 (Weak Password Requirements) is only exploitable when server-side enforcement is missing. NIST 800-63B §5.1.1.2 (Memorized Secret Verifiers) sets a minimum of 8 characters and specifically warns against composition rules; PCI-DSS Req-8.3.6 requires at least 12 characters. OWASP A07 lists weak password policies as an authentication failure. A single-character password accepted by your API means every user who sets a simple password has a credential that can be brute-forced in seconds from any leaked hash.

Enforce password requirements in the API route, not just the React component. Run validation before hashing so invalid passwords never touch the database:

function validatePassword(password: string): string | null {
  if (password.length < 12) return 'Password must be at least 12 characters'
  if (!/[A-Z]/.test(password)) return 'Must include an uppercase letter'
  if (!/[0-9]/.test(password)) return 'Must include a number'
  return null
}

export async function POST(request: Request) {
  const { email, password } = await request.json()
  const err = validatePassword(password)
  if (err) return Response.json({ error: err }, { status: 400 })
  // proceed to hash and create user
}

For Supabase Auth, configure minimum password length in the Supabase Dashboard under Auth > Settings > Password Requirements — Supabase enforces this server-side. Consider adding zxcvbn for entropy-based strength estimation alongside rule-based checks.