Hello! I'm new to mybatis-plus and when I was browsing the code I found the secret key is generated with get32UUID() function, and is truncated here.

    public static String generateRandomKey() {
        return IdWorker.get32UUID().substring(0, 16);
    }

get32UUID() do not provide enough randomness, and it's insecure to generate a secret key like this. SecureRandom can be used as a substitute.