Challenge 1 / 2

What's the BIG security issue we have right now?

The big issue is that the __serialize() method is storing the password in the session, which means it gets emailed to the user.

We’re saving real passwords as plain text in the database, so if someone gets the DB, they instantly know everyone’s password.

The big issue is that using email as the login ID is insecure, because attackers can’t be blocked if they know your email.

The big issue is that getRoles() always adds ROLE_USER, which gives anonymous users extra capabilities.