The seed checked only SEED_ADMIN_EMAIL. After the real admin changed their address, every start created a second ADMIN with a random password and wrote that password to the log. The seed now skips as soon as any user exists and never prints an operator-supplied password. seedAdmin() is exported for tests; main() runs only when the file is executed directly. Refs #45 Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>