Fix Snyk security findings: XSS, open redirect, hardcoded secrets, cookie security, MD5 replacement

src/lib/auth/laravel-encrypter.test.ts

@@ -6,10 +6,8 @@ import {
   phpUnserializeString,
 } from "./laravel-encrypter";
 
-// A deterministic 32-byte key in Laravel's "base64:" form.
-const APP_KEY = `base64:${Buffer.from(
-  "0123456789abcdef0123456789abcdef",
-).toString("base64")}`;
+// Dynamically generated 32-byte key so no secret is hardcoded in source.
+const APP_KEY = `base64:${randomBytes(32).toString("base64")}`;
 
 describe("LaravelEncrypter", () => {
   it("rejects a key that is not 32 bytes", () => {