What is wrong with Math.random() for secrets?

It's predictable pseudorandom, fails NIST entropy, seeds observable. Auditor kryptonite.

How do I generate secure random strings in Node.js?

Use crypto.randomBytes() or randomInt(). Drop-in utils exist. Entropy guaranteed.

Yes. Critical finding. Remediate now or eat 90-day delays.

🔒 Security & Privacy

Math.random() in production? Auditors will roast you. Swap it now or watch deals die.

theAIcatchup Apr 10, 2026 3 min read

Published by

Community-driven. Code-first.

#Math.random() #Node.js crypto #credential generation #security audit

Get the best Open Source stories of the week in your inbox — no noise, no spam.

Originally reported by Dev.to