Zennoxa Shield
Rules / Dart
SHIELD-DART-012

Insecure random for security tokens

mediumDartCWE-338CVSS 6.5

What it detects

The default Random() is not cryptographically secure and must not generate tokens or secrets.

How to fix

Use Random.secure() for any security-sensitive random value.

Vulnerable — Shield flags thisreset_token.dart
import 'dart:math';

String newResetToken() {
  final tokenRng = Random();
  return List.generate(24, (_) => tokenRng.nextInt(36).toRadixString(36)).join();
}
Fixed — scans cleanreset_token.dart
import 'dart:math';

String newResetToken() {
  final tokenRng = Random.secure();
  return List.generate(24, (_) => tokenRng.nextInt(36).toRadixString(36)).join();
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-012, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-012: Insecure random for security tokens — Zennoxa Shield