[Bug]: signup endpoint confirms registered emails by returning the existing user's email in the response body

[anshul23102]

Bug Summary

In backend/controllers/auth.controller.js, when a signup attempt uses an already-registered email, the endpoint echoes the existing user's email back in the response:

const existing = await User.findOne({ email });
if (existing) {
    return res.json({ email: existing.email });
}

This leaks registered email addresses. Any caller can enumerate which email addresses are registered by attempting signup and checking whether the response includes an email field. The response also returns HTTP 200 instead of HTTP 409 Conflict.

Steps to Reproduce

1. Register an account with test@example.com.
2. Attempt to register again with the same email.
3. Observe the response: { "email": "test@example.com" } with HTTP 200.
4. The presence of the email field confirms the address is registered.

Expected Behavior

The endpoint should return a generic error without revealing whether the email is registered:

if (existing) {
    return res.status(409).json({ error: 'Registration failed. Please try a different email.' });
}

Actual Behavior

The response body contains the exact email address of the existing user. This enables email enumeration attacks.

Environment

• Backend: Node.js / Express / Mongoose
• File: backend/controllers/auth.controller.js, function: signup

Additional Context

Expected NSOC points: NSOC'26 level2 (medium complexity security bug - email enumeration)

Suggested labels: bug, NSOC'26, level2

Checklist:

• Searched existing issues - not a duplicate
• Read CONTRIBUTING.md and project rules
• No AI/Claude mentions
• No em dashes or double hyphens
• Repository verified as NSOC

[anshul23102]

@omkarhole Could you please /assign this issue to me? I'd like to work on it under NSOC '26.