TL;DR



AI editors default to Math.random() for tokens because that's what nearly every tutorial and StackOverflow answer uses
Math.random() is not cryptographically secure, so tokens built from it can be predicted or brute-forced
Swap in crypto.randomBytes or crypto.randomUUID for anything security-sensitive


I was reviewing a password reset...