Programming Languages
Bug Report
Password reset tokens built with Python random are predictable: switch to secrets
A security review found that our password reset tokens and temporary passwords came from Python's random module. Its Mersenne Twister generator is fast and statistically good, but not unpredictable. We moved to secrets, hashed tokens at rest, and added Bandit to CI.