How browser cryptographic randomness works, when random tokens help in dev and testing, and why production secrets need proper secret-management workflows.