Hello! I'm new to mybatis-plus and when I was browsing the code I found the secret key is generated with get32UUID() function, and is truncated here.
public static String generateRandomKey() {
return IdWorker.get32UUID().substring(0, 16);
}
get32UUID() do not provide enough randomness, and it's insecure to generate a secret key like this. SecureRandom can be used as a substitute.