Weak Hash (ARCH9111)

Key swift.security.weak-hash · Severity error · Category security · CWE CWE-328

Flags CC_MD5 / CC_SHA1 and CryptoKit’s Insecure.MD5 / Insecure.SHA1.

Incorrect

let digest = Insecure.MD5.hash(data: data)

Correct

let digest = SHA256.hash(data: data)

Fix

Use SHA-256 or better; for passwords use a KDF.