First Flight #1: PasswordStore

In the PasswordStore.sol contract, specifically in the setPassword function, there are no checks to verify that only the owner can change the password. This allows any user to change the password, regardless of whether they are the owner or not.

Here is a simple POC in foundry to verify that any user can change the password:
function test_random_user_can_set_password() public {
vm.startPrank(address(1));
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
vm.stopPrank();
vm.prank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}

I recommend adding an ownership check on top of the function call to only allow the owner to make changes.

function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
s_password = newPassword;
emit SetNetPassword();
}