diff --git a/WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs b/WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs
index 3fc9c6d..a7248c1 100644
--- a/WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs
+++ b/WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs
@@ -28,6 +28,7 @@ namespace WelsonJS.Launcher
             Application.Run(new MainForm());
 
             mutex.ReleaseMutex();
+            mutex.Dispose();
         }
 
         public static void RunCommandPrompt(string workingDirectory, string entryFileName, string scriptName, bool isConsoleApplication = false, bool isInteractiveServiceAapplication = false)
diff --git a/WelsonJS.Toolkit/WelsonJS.Launcher/Tools/ResourceServer.cs b/WelsonJS.Toolkit/WelsonJS.Launcher/Tools/ResourceServer.cs
index 9f2e319..2f76b0e 100644
--- a/WelsonJS.Toolkit/WelsonJS.Launcher/Tools/ResourceServer.cs
+++ b/WelsonJS.Toolkit/WelsonJS.Launcher/Tools/ResourceServer.cs
@@ -105,7 +105,7 @@ namespace WelsonJS.Launcher.Tools
             const string devtoolsPrefix = "devtools/";
             if (path.StartsWith(devtoolsPrefix, StringComparison.OrdinalIgnoreCase))
             {
-                await ServeDevTools(context, path.Substring(devtoolsPrefix.Length - 1));
+                await ServeDevTools(context, path.Substring(devtoolsPrefix.Length));
                 return;
             }
 
@@ -129,7 +129,7 @@ namespace WelsonJS.Launcher.Tools
             const string tfaPrefix = "tfa/";
             if (path.StartsWith(tfaPrefix, StringComparison.OrdinalIgnoreCase))
             {
-                ServeTfaRequest(context, path.Substring(tfaPrefix.Length - 1));
+                ServeTfaRequest(context, path.Substring(tfaPrefix.Length));
                 return;
             }
 
@@ -178,7 +178,7 @@ namespace WelsonJS.Launcher.Tools
             {
                 using (HttpClient client = new HttpClient())
                 {
-                    string url = "http://localhost:9222" + endpoint;
+                    string url = "http://localhost:9222/" + endpoint;
                     string data = await client.GetStringAsync(url);
 
                     ServeResource(context, data, "application/json");
@@ -263,7 +263,7 @@ namespace WelsonJS.Launcher.Tools
         {
             Tfa _tfa = new Tfa();
 
-            if (endpoint.Equals("/pubkey"))
+            if (endpoint.Equals("pubkey"))
             {
                 ServeResource(context, _tfa.GetPubKey(), "text/plain", 200);
                 return;
diff --git a/WelsonJS.Toolkit/WelsonJS.Launcher/Tools/Tfa.cs b/WelsonJS.Toolkit/WelsonJS.Launcher/Tools/Tfa.cs
index 7621176..615e668 100644
--- a/WelsonJS.Toolkit/WelsonJS.Launcher/Tools/Tfa.cs
+++ b/WelsonJS.Toolkit/WelsonJS.Launcher/Tools/Tfa.cs
@@ -32,13 +32,19 @@ namespace WelsonJS.Launcher.Tools
 
         public string GetPubKey()
         {
-            var rand = new Random();
-            var key = new char[16];
-            for (int i = 0; i < 16; i++)
+            using (var rng = RandomNumberGenerator.Create())
             {
-                key[i] = Base32Chars[rand.Next(Base32Chars.Length)];
+                var key = new char[16];
+                var randomBytes = new byte[16];
+                rng.GetBytes(randomBytes);
+
+                for (int i = 0; i < 16; i++)
+                {
+                    key[i] = Base32Chars[randomBytes[i] % Base32Chars.Length];
+                }
+
+                return string.Join(" ", Enumerable.Range(0, 4).Select(i => new string(key, i * 4, 4)));
             }
-            return string.Join(" ", Enumerable.Range(0, 4).Select(i => new string(key, i * 4, 4)));
         }
 
         private static byte[] DecodeBase32(string key)