LLM-generated passwords are indefensible. Your codebase may already prove it