Potential fix for code scanning alert no. 2: Insecure randomness

[EthanThePhoenix38]

Potential fix for https://github.com/ThePhoenixAgency/AI-Pulse/security/code-scanning/2

In general, the fix is to stop using Math.random() when generating the session ID and instead use a cryptographically secure random source. In the browser, this is window.crypto.getRandomValues. We should generate enough random bytes, encode them (for example in base36/hex), and keep the overall format of the session ID (sess_<timestamp>_<random>) so existing functionality and storage keys continue to work.

The best minimal-change fix is to replace the body of generateSessionId() so that:

• It uses window.crypto / self.crypto to fill a Uint32Array or Uint8Array with secure random values.
• It converts those values into a reasonably short alphanumeric string, similar length to the previous .substr(2, 9).
• It keeps the prefix 'sess_' and timestamp Date.now() for backwards-compatibility in shape.

No other methods need to change, and no new external dependencies are required. All edits occur in tracker.js inside the shown generateSessionId method; imports are not needed because crypto.getRandomValues is a web standard global.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This pull request addresses a security vulnerability (code scanning alert #2) by replacing the insecure Math.random() with cryptographically secure crypto.getRandomValues() for session ID generation.

Key changes:

• Implements secure random generation using the Web Crypto API
• Generates 8 random bytes encoded as hex (16 characters) for the session ID
• Maintains backward compatibility with the existing session ID format (sess_<timestamp>_<random>)
• Includes a fallback to the old behavior for browsers without crypto support

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

String concatenation in a loop can be inefficient. Consider using Array.prototype.map() and join() for better performance:

const randomPart = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('');

This is more idiomatic and slightly more performant than building the string with repeated concatenations.

Suggested change

	let randomPart = '';
	for (let i = 0; i < bytes.length; i++) {
	randomPart += bytes[i].toString(16).padStart(2, '0');
	}
	const randomPart = Array.from(
	bytes,
	byte => byte.toString(16).padStart(2, '0')
	).join('');