diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..05cd004
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+.git
+.gitignore
+docs/
+*.md
+LICENSE
+VERSION
+dist/
+*.json
+*.exe
diff --git a/Dockerfile b/Dockerfile
index f82d5aa..3c30328 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@ WORKDIR /app
 COPY go.mod go.sum* ./
 RUN go mod download 2>/dev/null || true
 COPY . .
-RUN CGO_ENABLED=0 go build -o hookrelay ./cmd/hookrelay
+RUN CGO_ENABLED=0 go build -trimpath -o hookrelay ./cmd/hookrelay
 
 FROM alpine:3.20
 RUN apk add --no-cache ca-certificates
diff --git a/Makefile b/Makefile
index 638f36b..5c3646a 100644
--- a/Makefile
+++ b/Makefile
@@ -4,10 +4,10 @@ BINARY=hookrelay
 CMD_DIR=cmd/hookrelay
 
 build:
-	CGO_ENABLED=0 go build -o $(BINARY) ./$(CMD_DIR)
+	CGO_ENABLED=0 go build -trimpath -o $(BINARY) ./$(CMD_DIR)
 
 test:
-	go test ./...
+	go test ./... -count=1 -race
 
 vet:
 	go vet ./...
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index aefeb27..aedeb56 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -16,8 +16,11 @@ type AuthService struct {
 // New creates a new AuthService.
 func New(secret string) *AuthService {
 	if secret == "" {
+		// Generate a random secret
 		b := make([]byte, 32)
-		rand.Read(b)
+		if _, err := rand.Read(b); err != nil {
+			panic(fmt.Sprintf("crypto/rand failed: %v", err))
+		}
 		secret = hex.EncodeToString(b)
 	}
 	return &AuthService{secret: secret}
@@ -26,7 +29,9 @@ func New(secret string) *AuthService {
 // GenerateToken creates a new bearer token.
 func (a *AuthService) GenerateToken(workspace string) string {
 	b := make([]byte, 24)
-	rand.Read(b)
+	if _, err := rand.Read(b); err != nil {
+		panic(fmt.Sprintf("crypto/rand failed: %v", err))
+	}
 	h := sha256.Sum256(append(b, []byte(a.secret)...))
 	return "hr_" + hex.EncodeToString(h[:16])
 }
@@ -34,7 +39,9 @@ func (a *AuthService) GenerateToken(workspace string) string {
 // GenerateOTP creates a 6-digit OTP code.
 func (a *AuthService) GenerateOTP() string {
 	b := make([]byte, 4)
-	rand.Read(b)
+	if _, err := rand.Read(b); err != nil {
+		panic(fmt.Sprintf("crypto/rand failed: %v", err))
+	}
 	val := uint32(b[0])<<24 | uint32(b[1])<<16 | uint32(b[2])<<8 | uint32(b[3])
 	code := fmt.Sprintf("%06d", val%1000000)
 	return code
@@ -44,7 +51,9 @@ func (a *AuthService) GenerateOTP() string {
 func GenerateHandle(prefix string) string {
 	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
 	b := make([]byte, 5)
-	rand.Read(b)
+	if _, err := rand.Read(b); err != nil {
+		panic(fmt.Sprintf("crypto/rand failed: %v", err))
+	}
 	for i := range b {
 		b[i] = charset[int(b[i])%len(charset)]
 	}