diff --git a/server.js b/server.js
index 49052d4..466ddd0 100644
--- a/server.js
+++ b/server.js
@@ -113,6 +113,7 @@ app.use((req, res, next) => {
 app.use((req, res, next) => {
   res.setHeader("X-Frame-Options", "DENY");
   res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-XSS-Protection", "1; mode=block");
   res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
   res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
   res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
diff --git a/src/helpers/anilist.js b/src/helpers/anilist.js
index 27f8343..0682b54 100644
--- a/src/helpers/anilist.js
+++ b/src/helpers/anilist.js
@@ -609,7 +609,7 @@ const getAllGenres = async () => {
 const getAllTags = async () => {
   const gql = `query { MediaTagCollection { name description category isGeneralSpoiler isMediaSpoiler isAdult } }`;
   const data = await anilistQuery(gql);
-  return data.TagCollection;
+  return data.MediaTagCollection;
 };
 
 // ══════════════════════════════════════════════════════════════
diff --git a/src/routes/apiRoutes.js b/src/routes/apiRoutes.js
index 119058b..4a1228e 100644
--- a/src/routes/apiRoutes.js
+++ b/src/routes/apiRoutes.js
@@ -320,8 +320,9 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
   // ---- FEATURE: Random anime of the day ----
   router.get("/random", async (req, res) => {
     try {
-      // NOTE: Get random page from trending to ensure variety
-      const randomPage = Math.floor(Math.random() * 50) + 1;
+      // NOTE: Use crypto for better randomness in serverless + wider range for variety
+      const crypto = require("crypto");
+      const randomPage = crypto.randomInt(1, 500);
       const data = await anilist.getCollection("POPULARITY_DESC", null, randomPage, 1);
       const anime = data.results[0];
 
@@ -505,7 +506,8 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
 
       jsonResponse(res, result);
     } catch (err) {
-      jsonError(res, err.message);
+      const status = err.message.includes("not found") ? 404 : 500;
+      jsonError(res, err.message, status);
     }
   });
 
@@ -524,7 +526,8 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
 
       jsonResponse(res, result);
     } catch (err) {
-      jsonError(res, err.message);
+      const status = err.message.includes("not found") ? 404 : 500;
+      jsonError(res, err.message, status);
     }
   });