How severe is insecure randomness for tokens?

Shield rates this medium (CVSS 6.5), classified as CWE-330.

Rules / Ruby

SHIELD-RUBY-020

Insecure randomness for tokens

mediumRubyCWE-330CVSS 6.5

Using rand or Random for security tokens produces predictable values.

Generate tokens with SecureRandom.hex or SecureRandom.uuid.

Vulnerable — Shield flags thisapp/models/password_reset.rb

class PasswordReset
  def generate_token
    self.token = rand(10**20).to_s
  end
end

Fixed — scans cleanapp/models/password_reset.rb

require "securerandom"

class PasswordReset
  def generate_token
    self.token = SecureRandom.hex(32)
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-020, the fixed one does not.