fix: the application uses md5 to hash api keys befor... in routes.py

[anupamme]

Summary

Fix high severity security issue in app/routes.py.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	app/routes.py:15617
Assessment	Likely exploitable
Chain Complexity	2-step

Description: The application uses MD5 to hash API keys before storage/comparison. MD5 is cryptographically broken and unsalted, making it vulnerable to rainbow table and GPU-based brute-force attacks.

Evidence

Exploitation scenario: Attacker obtains MD5 hash via database breach or injection, uses hashcat/rainbow tables to recover original API key, then authenticates as any user.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• app/routes.py

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security