· about 3 hours ago· Dev.to
Math.random() Lacks True Randomness, Discovered While Generating API Keys in Popular Repo.
I found this in our benchmark corpus, extracted verbatim from Cal.com's Make integration setup (~44K GitHub stars): const apiKey = `cal_live_${Math.random().toString(36).substring(2)}`; An attacker who observes a handful of these keys can predict the next one. That is not a theoretical risk — it is
#cloud-security#api-keys#random-number-generation#cybersecurity-vulnerabilities#javascript-security