The default Random() is not cryptographically secure and must not generate tokens or secrets.
Use Random.secure() for any security-sensitive random value.