Weak randomness (ARCH6115)

Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.

Key ruby.security.weak-random · Severity warning · Category security · CWE CWE-338

Using a non-cryptographic PRNG like rand/Random for security values such as tokens, keys, salts, OTPs, or session ids makes the generated value predictable.

Incorrect

def token
  rand(10**10).to_s
end

Correct

def token
  SecureRandom.hex(16)
end

Fix

Use a cryptographically secure generator like SecureRandom for security-sensitive values.