I'm wondering about the security of the generators and hashes you use. SHA-256 is to my knowledge fine, however the Mersenne twister used by Python isn't (see http://en.wikipedia.org/wiki/Mersenne_twister, although there may be modifications in Python). You have little plaintext, so I can't really find anything obvious, but given the nature of the site, you may want to use something cryptographically secure.