diff --git a/README.md b/README.md
index 2f2416d..c68f88f 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,8 @@
 - Login with your username found on your name badge and set the initial password for your account:  https://git.aspp.school/user/login
 - You'll have to type that password many many times this week: choose wisely!
 - We will use the [exercise](exercise.md) in the repo for the rest of the lecture
+- find a partner to do pair-programming for this lecture by finding someone with the same tarot card as you
+- before starting, make yourself acquainted with the meanining and the power of the tarot cards: carefully read [this booklet](https://aspp.school/wiki/_media/tarot-runic.pdf)
 
 ## A cautionary quote
 
@@ -13,9 +15,33 @@
 
 — Lars Wirzenius (Linux kernel developer)
 
-## Lecture notes
+## Warm-Up
+- how to start a repo from scratch?
+    - `git init` local method
+    - on an online forge (GitHub, GitLab, …): `git clone`
+- how to revert mistakes?
+    - before commit:
+      - `git restore <file>` [discard changes in the working directory] __changes files__
+      - `git restore --staged <file>` [unstage changes ➔ opposite of `git add <file>`, does not modify the working directory]
+    - after commit:
+      - `git revert <commit>` [creates a new commit, modifies the working directory]
+      - `git reset <commit>` [only reset the HEAD pointer, does not modify the working directory] __rewrites history__ ➔ can not be used if you have already pushed to some remote
+      - `git reset --hard <commit>` [reset HEAD and modify working directory] __rewrites history__ and __changes files__ ➔ can not be used if you have already pushed to some remote
+- how to *move* the whole working directory to a specific point in history?
+    - `git checkout <commit>` ➔ `DETACHED HEAD` problem, __changes__ __files__
+    - interaction with branches: `git branch <branch_name>` + `git switch <branch_name>` 
+- how to copy a file from a different branch:
+    - `git checkout <branch> <file>` ➔ the file is staged automatically
+    - `git restore --source=<branch> <file` ➔ the file is not staged
+- `git gui`: building commits along the way interactively (for the *mess around* type of workflows)
+- check out these [sketches](git-commands-visualizations.pdf) for a graphical visualization of git commands!
 
-… will follow after the lecture …
+## The Open Source model
+- remotes: `git pull <from_where> <what>`, `git push <where> <what>`, `git fetch <from_where> <what>`, `git merge <another_branch>`
+- GitHub: forks, branches and PRs: important ➔ explain fork vs. clone!!!
+- strategies for keeping your fork up-to-date: your `main`, origin's and upstream's `main`, short-lived and long-lived topic branches
+- a more thorough and detailed explanation can be found on the [SciPy Contributor's Guide](https://docs.scipy.org/doc/scipy/dev/gitwash/gitwash.html). This guide can be adapted to your own needs, see [gitwash](https://github.com/matthew-brett/gitwash).
+- make it clear that GitHub and GitLab are just options (git≠GitHub)
 
 ## Scenarios
 1. [lone scientist](scenarios/scenario1.png) working alone in the cellar without Internet (local git)
diff --git a/auth.py b/auth.py
index aed1472..5408393 100644
--- a/auth.py
+++ b/auth.py
@@ -1,48 +1,88 @@
+import getpass
 import json
+import pathlib
+import random
+import string
 import sys
-from getpass import getpass
 
-pwdb_path = 'pwdb.json'
+# name of the file where we store the pw database
+PWDB_FLNAME = pathlib.Path('pwdb.json')
+
+# list of valid characters for salt (only ASCII letters + digits + punctuation)
+CHARS = string.ascii_letters + string.digits + string.punctuation
+
+# length of salt
+SALT_LENGTH = 5
 
 def get_credentials():
+    # get input from terminal
     username = input('Enter your username: ')
-    password = getpass('Enter your password: ')
+    # get password using the appropriate module, so that typed characters are not
+    # echoed to the terminal
+    password = getpass.getpass('Enter your password: ')
     return (username, password)
 
-def authenticate(username, password, pwdb):
-    return password == pwdb[username]
+def authenticate(username, pass_text, pwdb):
+    # get the salt from the database
+    salt = pwdb[username][1]
+    # calculate hash and compare with stored hash
+    return pwhash(pass_text, salt) == pwdb[username][0]
 
 def add_user(username, pwdb):
-    pwdb[username] = input(f'Enter password for {username}: ')
+    # do not try to add a username twice
+    if username in pwdb:
+        raise Exception(f'Username already exists [{username}]!')
+    else:
+        password = getpass.getpass(f'Enter password for {username}: ')
+        salt = get_salt()
+        pwdb[username] = (pwhash(password,salt), salt)
     return pwdb
 
 def read_pwdb(pwdb_path):
-    try:
-        pwdb_file = open(pwdb_path, 'rt')
-        pwdb = json.load(pwdb_file)
-    except Exception:
+    if not pwdb_path.exists():
         pwdb = {}
+    else:
+        with open(pwdb_path, 'rt') as pwdb_file:
+            pwdb = json.load(pwdb_file)
     return pwdb
 
 def write_pwdb(pwdb, pwdb_path):
-    pwdb_file = open(pwdb_path, 'wt')
-    json.dump(pwdb, pwdb_file)
+    with open(pwdb_path, 'wt') as pwdb_file:
+        json.dump(pwdb, pwdb_file)
 
+def pwhash(pass_text, salt):
+    # simple additive hash -> very insecure!
+    hash_ = 0
+    full_pass_text = pass_text + salt
+    for idx, char in enumerate(full_pass_text):
+        # use idx as a multiplier, so that shuffling the characters returns a
+        # different hash
+        hash_ += (idx+1)*ord(char)
+    return hash_
 
-if __name__ == "__main__":
-    pwdb_path = 'pwdb.json'
+def get_salt():
+    salt_chars = random.choices(CHARS, k=SALT_LENGTH)
+    return ''.join(salt_chars)
+
+def main(pwdb_path):
+    # load the password database from file
     pwdb = read_pwdb(pwdb_path)
 
+    # if we are passed an argument, we want to add a new user
     if len(sys.argv) > 1:
         pwdb = add_user(sys.argv[1], pwdb)
         write_pwdb(pwdb, pwdb_path)
-    else:
-        username, password = get_credentials()
-        if username not in pwdb:
-            print('Wrong username!')
-        else:
-            if authenticate(username, password, pwdb):
-                print('Successfully authenticated!')
-            else:
-                print('Wrong password!')
+        return
+
+    # ask for credentials
+    username, password = get_credentials()
+    if username not in pwdb or not authenticate(username, password, pwdb):
+        print('Wrong username or password!')
+    else:
+        print('Successfully authenticated!')
+
+    return
+
+if __name__ == '__main__':
+    main(PWDB_FLNAME)
 
diff --git a/cheatsheet.md b/cheatsheet.md
new file mode 100644
index 0000000..813aa43
--- /dev/null
+++ b/cheatsheet.md
@@ -0,0 +1,176 @@
+# Git cheatsheet
+
+## Creating a repository
+```bash
+git init
+```
+Creates new git repository in current directory.
+
+```bash
+git clone <url> (<path>)
+```
+Clones the repository at the specified url. If no path is specified, the repository will
+be cloned into a directory with the same name as the remote repository.
+
+
+## Branches
+```bash
+git branch
+```
+Lists all branches in the repository.
+
+```bash
+git branch <branch-name>
+```
+Creates a new branch with the given name.
+
+```bash
+git switch <branch-name>
+```
+Switches to the specified branch.
+
+```bash
+git merge <branch-name>
+```
+Merges the specified branch into the current branch.
+
+
+## Making changes
+```bash
+git status
+```
+Shows the status of the repository. This includes the current branch and files that have been modified.
+
+```bash
+git diff (--staged)
+```
+Shows the changes that have been made to the files in the repository. Use `--staged` to see changes that have been added to the staging area.
+
+```bash
+git add <file>
+```
+Adds the specified file to the staging area.
+
+```bash
+git add .
+```
+Adds all files in the current directory to the staging area.
+
+```bash
+git reset (<file>)
+```
+Removes the specified file from the staging area. If no file is specified, all files are removed.
+
+```bash
+git commit (-m "<message>")
+```
+Commits all changes in the staging area to the current branch. If the `-m` flag is omitted, a text editor will open to write a commit message.
+
+```bash
+git commit --amend
+```
+Adds the staged changes to the last commit. This can be used for fixing typos in the commit message.
+
+
+## Undoing changes
+```bash
+git restore <file>
+```
+Restores the specified file to the state of the last commit. This undoes uncommitted changes.
+
+```bash
+git revert <commit>
+```
+Creates a new commit that undoes the changes of the specified commit. Use `git log` to find the hash of the commit.
+
+```bash
+git reset --hard <commit>
+```
+Resets the current branch to the specified commit. DANGER: This will remove all changes after the specified commit. Prefer `git revert`.
+
+
+## Looking at the history
+```bash
+git log (--oneline)
+```
+Shows all past commits on the current branch. Use `--oneline` to show a more compact view.
+
+```bash
+git show <commit>
+```
+Shows the changes of the specified commit. Use `git log` to find the has of the commit.
+
+
+## Remote repositories
+```bash
+git remote add <remote> <url>
+```
+Adds a new remote repository with the specified name (e.g. `origin` or `upstream`) and url. Origin is automatically created when cloning a repository.
+
+```bash
+git push <remote> <branch>
+```
+Pushes the specified branch to the remote repository.
+
+```bash
+git fetch <remote>
+```
+Fetches changes from the remote repository.
+
+```bash
+git pull <remote> <branch>
+```
+Fetches changes from the remote repository and merges them into the current branch.
+
+
+## Typical workflow
+```bash
+# 1. Fork the repository on GitHub / git.aspp.school
+
+# 2. Clone the repository
+git clone <fork-url>
+git remote add upstream <upstream-url>
+
+# 3. Create a new branch
+git branch <topic-branch>
+git switch <topic-branch>
+
+# 4. Make changes to the code
+
+# 5. Add and commit changes
+git add .
+git commit -m "<message>"
+
+# 6. Push changes to your fork
+git push origin <topic-branch>
+
+# 7. Create a pull request on GitHub / git.aspp.school
+
+# 8. Wait for the pull request to be reviewed and merged
+
+# 9. Pull changes from the remote repository
+git switch main
+git pull upstream main
+
+# 10. Delete the topic branch
+git branch -d <topic-branch>
+```
+
+Whenever the remote repository is updated (i.e. when a pull request is merged), you need to pull the changes into your local repository.
+```bash
+git switch main
+git pull upstream main
+
+# If you have an active topic branch, you need to rebase it on top of the updated main branch
+git switch <topic-branch>
+git rebase main
+```
+
+
+## Getting help
+```bash
+git help <command>
+```
+Shows the manual page for the specified command (`add`, `commit`, `push`, etc.).
+
+Official Git documentation: https://git-scm.com/docs