You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It seems that it is used in the wild to generate catchy identifiers e.g. "my-collection/bikes/elegant-green-coat" but also sometimes to generate easy to remember passwords. How exactly the library will be used is not fully under the control of the library author. However, there is an actionable mitigation to avoid to the users the "footgun" of inadvertently opening a security hole: use crypto.getRandomValues() (instead of Math.random()).
Would you like me to open a PR?
The text was updated successfully, but these errors were encountered:
Hello, thank you for the nice library.
It seems that it is used in the wild to generate catchy identifiers e.g.
"my-collection/bikes/elegant-green-coat"
but also sometimes to generate easy to remember passwords. How exactly the library will be used is not fully under the control of the library author. However, there is an actionable mitigation to avoid to the users the "footgun" of inadvertently opening a security hole: usecrypto.getRandomValues()
(instead ofMath.random()
).Would you like me to open a PR?
The text was updated successfully, but these errors were encountered: