Insecure randomness (ARCH315)

Key dotnet.security.weak-random · Severity warning · Category security · CWE CWE-338

System.Random is a predictable PRNG that makes security values like tokens or keys guessable. Use a cryptographic generator.

Incorrect

var token = new byte[32];
new Random().NextBytes(token);

Correct

var token = RandomNumberGenerator.GetBytes(32);

Fix

Use RandomNumberGenerator instead of System.Random for all security-sensitive randomness.