Weak Random Number Generation in Security Context

Description

Detects use of Math.random() for security-sensitive operations like generating tokens, session IDs, or cryptographic keys. Math.random() is not cryptographically secure and can be predicted by attackers.

What Shoulder detects

Math.random() used for security-sensitive operation: {context}

How to fix

Replace Math.random() with cryptographically secure alternatives.

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

express fastify

References

Documentation ↗ OWASP ↗ Learn about CWE-338

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-weak-random .