Zennoxa Shield
Rules / Python
SHIELD-PY-014

Insecure random number for security purposes

mediumPythonCWE-338CVSS 5.3

What it detects

random.random() and random module are not cryptographically secure.

How to fix

Use secrets module (secrets.token_bytes, secrets.choice) for security-sensitive randomness.

Vulnerable — Shield flags thistokens.py
import random
import string

def generate_reset_token() -> str:
    alphabet = string.ascii_letters + string.digits
    return "".join(random.choice(alphabet) for _ in range(32))
Fixed — scans cleantokens.py
import secrets
import string

def generate_reset_token() -> str:
    alphabet = string.ascii_letters + string.digits
    return "".join(secrets.choice(alphabet) for _ in range(32))

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-014, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-014: Insecure random number for security purposes — Zennoxa Shield