Thank you for your response. So how should I protect the passwords? I assume you mean the users password?

Why source code is not the value? If they could hack it, then they can just deploy the same code in a matter of weeks?

oh, any suggestion on how to implement the admin backend access? Currently my admin access is just a subdomain, which I think is not secure access (although it requires admin credentials to access it).

Thank you.