When you use Reset Account (from User Icon > Settings > "Danger Zone" section), it correctly sets your Level to 1 but it does not reset your Stat Points. It should reset them as described below.

Ideally we'd fix this with the generic function described at HabitRPG/habitica#6482 but that requires a large body of

It would be better to use bcrypt, beause its more secure as it's slower (uses more computing cycles).
Your code could also be better:

You wouldn't need salt field in User model, because it's saved into the same field as password does.

For authentication, something like:

var mongoose = require('mongoose'),
  bcrypt = require('bcryptjs');

var userSchema = mongoose.Schema({
  email: String,

E.g.

check('email').isEmail().withMessage({
	message: 'Not an email',
	errorCode: ErrorCodes.NOT_EMAIL,
})

To support express-validator/express-validator#667 (comment).

Hi,

Can someone explain what is the purpose of having the Events object in the cloudformation file? The reason why I ask is that I was able to comment it out, rebuild the stack and still be able to create a user (POST /users).

Thanks.