Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-013

Insecure random used for security tokens

mediumKotlinCWE-338CVSS 5.3

What it detects

java.util.Random or kotlin.random.Random is predictable and must not be used to generate tokens, keys, or nonces.

How to fix

Use java.security.SecureRandom for any security-sensitive random values.

Vulnerable — Shield flags thisTokenGenerator.kt
import java.util.Random

fun issueResetToken(): String {
    val rng = Random()
    return (1..32).map { "0123456789abcdef"[rng.nextInt(16)] }.joinToString("")
}
Fixed — scans cleanTokenGenerator.kt
import java.security.SecureRandom

fun issueResetToken(): String {
    val rng = SecureRandom()
    return (1..32).map { "0123456789abcdef"[rng.nextInt(16)] }.joinToString("")
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-013, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-013: Insecure random used for security tokens — Zennoxa Shield