File: userAuth.controller.js
OTPs are generated using Math.random(), which is not cryptographically secure. An attacker who can predict the RNG state could forge OTPs.
const otp = Math.floor(100000 + Math.random() * 900000).toString();
The dashboard-api already uses crypto.randomInt() in auth.controller.js,
The public-api should follow the same pattern for consistency and security.
File: userAuth.controller.js
OTPs are generated using Math.random(), which is not cryptographically secure. An attacker who can predict the RNG state could forge OTPs.
The dashboard-api already uses crypto.randomInt() in
auth.controller.js,The public-api should follow the same pattern for consistency and security.