Insecure Randomness For Secrets

Vulnerable vs. safe

const sessionToken = Math.random().toString(36).slice(2);

const discountAmount = Math.random() * 100;

Why it matters & how to fix it

Math.random() is not cryptographically secure and is being used to build a security-sensitive value (token/secret/OTP/etc.). Use crypto.randomBytes()/crypto.randomUUID() for unpredictable values.

References

• https://cwe.mitre.org/data/definitions/338.html
• https://nodejs.org/api/crypto.html#cryptorandombytessize-callback

Related checks

• JavaScript / TypeScript - Cryptography
  Weak Cipher Algorithm
• JavaScript / TypeScript - Cryptography
  Weak Hash Algorithm
• Python - Cryptography
  Insecure Random Token
• Python - Cryptography
  Weak Cipher DES ECB
• Python - Cryptography
  Weak Hash MD5 SHA1
• Java - Cryptography
  Hardcoded Crypto Key IV