Weak random (ARCH3115)

Key typescript.security.weak-random · Severity warning · Category security · CWE CWE-338

Using a non-cryptographic PRNG like Math.random() for security-sensitive values such as tokens, keys, salts, or session ids makes those values predictable.

Incorrect

function makeToken(): string {
  // Math.random is not cryptographically secure
  return Math.random().toString(36).slice(2);
}

Correct

import { randomBytes } from "crypto";

function makeToken(): string {
  return randomBytes(32).toString("hex");
}

Fix

Use a cryptographically secure source like crypto.randomBytes for security-sensitive values.