Hello,

1) Account sharing is not permitted. Only one person is permitted per account, and publicly posting the password is not allowed. As such, I have reset the password on this account and you will need to change it via the forgot password page should you wish to use it again.

(Note that usually account sharing / password sharing is cause for a ban, however, that is not being done in this case as this seems to be in connection with a well intentioned security report. In future, if there is a security issue where you feel it is necessary to report the password, please report that privately. There is a private checkbox on the issue report page, or e-mail/discord/etc all work, too)

2) Passwords are cryptographically secured on the server side via PHP's standard password_hash() function.

https://www.php.net/manual/en/function.password-hash.php

As logins are done with SSL, there is not a risk of password leakage. This is how the majority of consumer-grade websites function.

While it is technically possible to add additional hash on the client side (as you suggest) with javascript, adding another potential point of failure adds risk:
1) The client side hashing function might result in a less secure result that is passed to the server
2) There may be some exploit to the client side hashing function or some other attack vector
3) The client side hashing function might have to be changed at some point due to the above or another reason, causing all old user passwords to be invalidated, potentially permanently locking large numbers of people out of their accounts should they no longer have access to their original e-mails.

Because of that, my intent is to keep the login code simple and secure by using the same logic as is used by the majority of websites. Ie: Regular login form on client -> SSL -> standards based password_hash() on server.

This is not 'sketchy,' this is the standard implementation. Relying on non-standardized clientside Javascript for security instead of auto-updated, widely deployed & well tested server code is not the way.