Math.random() Is Not Random Enough. I Found It Building API Keys in a 44K-Star Repo.
7.4 relevance
Score Breakdown
technical depth 8
novelty 7
actionability 8
community 7
strategic 5
personal 8
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Critical security flaw in popular open-source repo with actionable fix.
Summary
Cal.com's 44K-star open-source scheduling platform used Math.random() to generate API keys, but V8's xorshift128+ PRNG is deterministic — tools like v8_rand_buster recover internal state from 3–4 consecutive outputs, allowing attackers to predict future keys. The article recommends crypto.randomBytes or similar CSPRNG and an ESLint rule (eslint-plugin-node-s) to catch this insecure pattern.