Add vulnerable-test.js with MD5 hashing example

[Bot-GJ16]

This file demonstrates the use of MD5 for hashing and includes hardcoded credentials, which are flagged by CodeQL as vulnerabilities.

[gemini-code-assist]

Code Review

This pull request introduces a new test file vulnerable-test.js that contains critical security vulnerabilities. Specifically, it uses the cryptographically broken MD5 algorithm for hashing and includes a hardcoded database password. The review comments correctly identify these security issues and provide actionable suggestions to use a secure hashing algorithm like scrypt and to load credentials from environment variables.

[gemini-code-assist]

MD5 is a cryptographically broken hashing algorithm and should not be used for hashing passwords due to collision vulnerabilities. Use a strong, slow hashing algorithm like bcrypt or the built-in crypto.scrypt instead.

Suggested change

	const hash = crypto.createHash('md5').update('secret').digest('hex');
	const hash = crypto.scryptSync('secret', 'salt', 64).toString('hex');

[gemini-code-assist]

Hardcoding credentials in source code exposes them to unauthorized access and version control history leaks. Use environment variables or a secrets manager to retrieve sensitive configuration values.

Suggested change

	const dbPassword = "SuperSecretHardcodedPassword123!";
	const dbPassword = process.env.DB_PASSWORD;