Insecure Random Number Generation

Description

Detects use of insecure random number generators (random module) for security-critical operations. Use secrets module or os.urandom() for cryptographic randomness (tokens, passwords, keys, nonces).

How to fix

Use the secrets module for tokens, passwords, and security-sensitive operations.

```python
import secrets

# Generate secure token
token = secrets.token_urlsafe(32)

# Generate secure hex token
reset_token = secrets.token_hex(32)

# Generate secure bytes for keys/salt
key = secrets.token_bytes(32)
```

Learn more: https://shoulder.dev/learn/python/cwe-338/insecure-randomness

Applies to

Languages

🐍 Python

References

Documentation ↗ Learn about CWE-338

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=python-insecure-randomness .