Summary

Restrict salt and stored-hash validation to the formats supported by the bundled bcrypt implementation: versions 2a, 2b, 2x, and 2y; costs 04–31; and exact salt/hash lengths. Fixes #133.

Reproduction

The current regexes accept unsupported versions such as $00$/$2z$, costs outside 04–31, and overlong salts. hash_secret then passes these values into the native layer, which returns no hash instead of raising BCrypt::Errors::InvalidSalt; Password.valid_hash? likewise reports structurally unsupported hashes as valid.

Verification

• External baseline/fixed model covers all four supported versions, minimum/maximum costs, unsupported versions, costs 03/32/99, overlong salts, stored hashes, and the InvalidSalt boundary.
• The complete suite passes 39 examples on Ruby 4.0.6 for both current master and a 3.1.22-based consumer.
• All existing Openwall/Spring interoperability vectors remain green.

Limits

JRuby and non-macOS native builds were not executed locally. The accepted formats are derived from both bundled implementations and their existing vectors.

Compatibility

Proper bcrypt salts and hashes are unchanged. Inputs that the native implementation cannot process now fail Ruby validation instead of reaching the native layer.