diff --git a/.gitignore b/.gitignore
index d2e16bc..8fb58d3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,6 @@
 .vscode/
 .DS_Store
 Thumbs.db
+
+# uploaded files
+**/uploads/
diff --git a/init-db.sql b/init-db.sql
index 547187a..0932958 100644
--- a/init-db.sql
+++ b/init-db.sql
@@ -9,6 +9,7 @@ DROP TABLE IF EXISTS bantuan_detail;
 DROP TABLE IF EXISTS lokasi;
 DROP TABLE IF EXISTS users;
 DROP TABLE IF EXISTS migrations;
+DROP TABLE IF EXISTS verification_attempts;
 SET FOREIGN_KEY_CHECKS = 1;
 
 CREATE TABLE users (
@@ -32,6 +33,7 @@ CREATE TABLE users (
   created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
   approved_by INT UNSIGNED DEFAULT NULL,
   approved_at DATETIME DEFAULT NULL,
+  rejection_reason TEXT DEFAULT NULL,
   PRIMARY KEY (id),
   UNIQUE KEY uq_users_email (email),
   KEY idx_users_status (status),
@@ -40,6 +42,17 @@ CREATE TABLE users (
   CONSTRAINT fk_users_approved_by FOREIGN KEY (approved_by) REFERENCES users (id) ON DELETE SET NULL ON UPDATE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
+CREATE TABLE verification_attempts (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  email VARCHAR(255) NOT NULL,
+  attempts INT NOT NULL DEFAULT 1,
+  code_hash VARCHAR(255) NOT NULL,
+  expires_at DATETIME NOT NULL,
+  last_attempt_at DATETIME NOT NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY uq_verification_attempts_email (email)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
 -- Insert Admin and Manager demo accounts (Password: password)
 INSERT INTO users (email, password_hash, name, organization, role, status, email_verified)
 VALUES