Weak randomness (ARCH2115)

Key python.security.weak-random · Severity warning · Category security · CWE CWE-338

The random module is predictable and must not be used for security-sensitive values like tokens, keys, salts, or session ids. Use the secrets module.

Incorrect

import random
import string

def make_token():
    return "".join(random.choice(string.ascii_letters) for _ in range(32))

Correct

import secrets

def make_token():
    return secrets.token_urlsafe(32)

Fix

Use a cryptographic PRNG such as secrets or os.urandom for security-sensitive values.