Weak Random (ARCH9115)

Key swift.security.weak-random · Severity warning · Category security · CWE CWE-338

Flags rand(), drand48, random() and Int.random used for tokens, keys, nonces or passwords.

Incorrect

let token = String(Int.random(in: 0...Int.max), radix: 16)

Correct

var bytes = [UInt8](repeating: 0, count: 32)
_ = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)

Fix

Use SecRandomCopyBytes or SystemRandomNumberGenerator for anything security-sensitive.