http://maverick.i2p/blog/darknet-dev
Session tokens, reset links, and API keys must be long, unpredictable, and generated via OS-level cryptographically secure random generators (CSPRNG), not weak pseudo-random libraries or timestamp hashes. Login endpoints must enforce aggressive rate limiting and monitoring because attackers constantly test credential reuse from breached datasets.