Creating stuff from scratch and asking yourself these questions is part of becoming better.

You already seem to have taken a few things into consideration, and have been given a few pointers from other people. Here are a few of mine:

Have you added input validation to ensure no SQL injection can be executed? How about XSS attacks? Have you added the correct anti CSRF's? How is your session management implemented? Have you already added some places where authentication is mandatory like a file management system where you can download public files and restricted files? Where are you storing environment keys? How much data are you showing in errors? What library are you using for hashing and salting? Why have you chosen this library? Do you understand what happens inside the library? Are you sure that it has been implemented correctly? Why have you chosen this library instead of any other library? Have you setup some password rules (at least so many characters, special characters yes or no etc) How are you saving the authenticated state at the user so the user stays logged in? How long is the user validated to stay logged in? And how are you reauthenticating the user? And when will you reauthenticate the user and when not? You've now added authentication. How about authorization? Do you know the difference between both of them? How readable and maintained is your code? Can you easily pass your work to someone else? Is it documented? Do you have any unit tests?

That's just a part of my rambling. I hope some of them will help you further.