diff --git a/dashcaddy-api/routes/openclaw.js b/dashcaddy-api/routes/openclaw.js
index f916534..5977c24 100644
--- a/dashcaddy-api/routes/openclaw.js
+++ b/dashcaddy-api/routes/openclaw.js
@@ -1,5 +1,6 @@
 const express = require('express');
 const http = require('http');
+const crypto = require('crypto');
 const { ok, errorResponse, notFound, conflict } = require('../src/utils/responses');
 
 /**
@@ -263,10 +264,5 @@ module.exports = function openClawRoutes(ctx) {
 // ── token generator ──────────────────────────────────────────────────────────
 
 function generateToken() {
-  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-  let result = '';
-  for (let i = 0; i < 32; i++) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return result;
+  return crypto.randomBytes(24).toString('base64url');
 }
diff --git a/dashcaddy-api/src/managers/port-lock-manager.js b/dashcaddy-api/src/managers/port-lock-manager.js
index d52ce39..73e4814 100644
--- a/dashcaddy-api/src/managers/port-lock-manager.js
+++ b/dashcaddy-api/src/managers/port-lock-manager.js
@@ -6,6 +6,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const lockfile = require('proper-lockfile');
 const platformPaths = require('../../platform-paths');
 const { log } = require('../utils/logging');
@@ -58,7 +59,7 @@ class PortLockManager {
       throw new Error('Ports must be a non-empty array');
     }
 
-    const lockId = `lock-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+    const lockId = `lock-${Date.now()}-${crypto.randomBytes(8).toString('hex')}`;
     const sortedPorts = [...new Set(ports)].sort((a, b) => parseInt(a) - parseInt(b));
     const acquiredLocks = [];
     const releaseFunctions = [];