[Security]: Email verification bypassed - isEmailVerified hardcoded to true on registration

[sahare77]

Summary of What Has Been Done

During user registration, the isEmailVerified field is being hardcoded or defaulted to true when saving the new user to the database. This completely bypasses the email verification requirement, allowing anyone to register with fake or unowned email addresses.

Changes Made

• Need to modify backend/controllers/authController.js and backend/models/User.js.
• Ensure isEmailVerified defaults to false in the Mongoose schema.
• Remove any hardcoded overrides in the registration controller.
• Ensure the user cannot log in or access protected routes until they successfully verify their email token.

Impact it Made

• Secures the platform from bot registrations and spam accounts.
• Ensures only verified email owners can access authenticated features and consume server resources.

[github-actions]

Thanks for creating this issue!

If you'd like to work on it, simply comment:

/claim

The first person to claim the issue will be assigned automatically.

Happy contributing!

[TanCodeX]

/claim

[github-actions]

✅ @TanCodeX has successfully claimed this issue!

You've been assigned. Happy coding!

Tip: Please open a Pull Request linked to this issue when you're ready.
Add Closes #1429 in your PR description.