I'm designing a webapp from ground up.
From a security standpoint, assuming in both cases I will be hashing with a salt, a peper and a proper hashing algorithm.
Am I better off storing the user credentials in a database table along with the rest of the data, or in its own local file?
More specifically, would a separated design where the database user table contains the userID, name, email, etc. And the userID, password, salt are stored in a local file on the system. Is it worth the pain to design separately from a security standpoint, regarding the possible vectors of attack in general and if they're successful, to make the system more resilient.