Insufficient Randomness Anti-Pattern

Severity: High

Summary

Insufficient randomness occurs when security-sensitive values (session tokens, password reset codes, encryption keys) are generated using predictable non-cryptographic PRNGs. AI models frequently suggest Math.random() or Python's random module for simplicity. These generators enable attackers to predict outputs after observing a few values, allowing token forgery, session hijacking, and cryptographic compromise.

The Anti-Pattern

Never use predictable, non-cryptographic random number generators for security-sensitive values.

BAD Code Example

// VULNERABLE: Using Math.random() to generate a session token.