Math.random() usage

[swetha8612]

As part of our company's security policy, we run all our application through fortify scan. Fortify scan raised a flag in jszip.js file where Math.random() has been used. It is suggesting to replace with window.crypto.getRandomValues(new Uint32Array(10))[0]. Could you please have a look. Thank you.

[jonkoops]

This is not really a security issue, so you can safely ignore this scanner result. Using the Crypto API is definitely something we want to explore, but that would introduce a breaking change, since the Crypto API is not universally available in all supported runtimes. Perhaps this can be done by providing a fallback to Math.random() when the API is not available.