Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-010

Insecure random number generation

mediumJavaScript / TypeScriptCWE-338CVSS 5.3

What it detects

Math.random() is not cryptographically secure and should not be used for security-sensitive operations.

How to fix

Use crypto.getRandomValues() or crypto.randomBytes() for security-sensitive randomness.

Vulnerable — Shield flags thisreset.js
// Password-reset flow
function generateResetToken() {
  const token = Math.random().toString(36).slice(2);
  return token;
}

module.exports = { generateResetToken };
Fixed — scans cleanreset.js
const crypto = require("crypto");

// Password-reset flow
function generateResetToken() {
  return crypto.randomBytes(32).toString("hex");
}

module.exports = { generateResetToken };

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-010: Insecure random number generation — Zennoxa Shield