Mostly mind this one:
Using Math.random is not cryptographically secure! Use bcrypt.setRandomFallback to set a PRNG.
Mostly mind this one: