Default password is changeme

[jfm-so]

Change the default password from changeme. A possible solution is to give admin rights to the first registered account.

[auscash]

Generate the hash from a user-chosen password for the default. This can lock down and should whitelist the administrator in some way.

Disallow logins with the administrator account unless they browse there from localhost, for example, or lock down with an IP of the administrator.

Then continue using something better than md5.