fix(usage): use secure coordinate randomness

[kilo-code-bot]

Summary

• Replaces Math.random() for benchmark latitude and longitude generation with Node crypto-backed integer randomness.
• Keeps the benchmark coordinate ranges unchanged while resolving CodeQL alert 246 for insecure randomness.

Verification

• N/A - script-only benchmark data generation change; no manual runtime path exercised.

Visual Changes

N/A

Reviewer Notes

• Scope is intentionally limited to the CodeQL finding at apps/web/src/scripts/usage/benchmark-insert-usage.ts lines 140-143.

Built for RSO by Kilo

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The updated commit refactors latitude and longitude coordinate generation into a shared randomCoordinate helper backed by crypto.randomInt, with no new bugs or security issues introduced.

Files Reviewed (1 file)

• apps/web/src/scripts/usage/benchmark-insert-usage.ts

---

Note: secureRandomInt(0, 1_000_000) produces integers in [0, 999_999] (Node.js crypto.randomInt upper bound is exclusive), so randomCoordinate(-90, 90) can reach at most ~89.9999 and never exactly 90, and similarly for longitude. This is negligible for benchmark coordinate data and not a bug, just worth being aware of.

---

_{Reviewed by claude-4.6-sonnet-20260217 · 249,402 tokens}

_{Review guidance: REVIEW.md from base branch main}

[RSO]

@kilocode-bot please fix the merge conflicts

[kilo-code-bot]

The merge conflicts in PR #3842 have been resolved. Here's a summary of what was done:

2 conflicts fixed in apps/web/src/scripts/usage/benchmark-insert-usage.ts:

1. Import conflict — Aligned the import alias to use secureRandomInt (from main via PR fix(usage): use secure random longitude #3839) instead of cryptoRandomInt, and updated the function body accordingly.
2. Longitude conflict — Kept this PR's cleaner randomCoordinate(-180, 180) abstraction (functionally equivalent to main's inline expression).

The branch has been rebased and force-pushed. PR #3842 should now be conflict-free and ready for review. ✅