Zennoxa Shield
Rules / Go
SHIELD-GO-005

Insecure random number generation via math/rand

mediumGoCWE-338CVSS 5.3

What it detects

math/rand is not cryptographically secure and must not be used for security operations.

How to fix

Use crypto/rand for security-sensitive randomness.

Vulnerable — Shield flags thisreset_token.go
package auth

import (
	"fmt"
	"math/rand"
)

func NewResetCode() string {
	// math/rand is predictable — reset codes can be guessed
	return fmt.Sprintf("%06d", rand.Intn(1000000))
}
Fixed — scans cleanreset_token.go
package auth

import (
	"crypto/rand"
	"encoding/base32"
)

func NewResetCode() (string, error) {
	var b [10]byte
	if _, err := rand.Read(b[:]); err != nil {
		return "", err
	}
	return base32.StdEncoding.EncodeToString(b[:]), nil
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-005: Insecure random number generation via math/rand — Zennoxa Shield