math/rand is not cryptographically secure and must not be used for security operations.
Use crypto/rand for security-sensitive randomness.