Catch insecure randomness for security tokens

Jun 26, 2026 · 1 min read

Tokens must come from a CSPRNG. Ordinary RNGs are seeded predictably and produce guessable values.

bash

grep -rEn "Math.random|new Random(|rand(|mt_rand|random.random(|uuid1(" --include=*.{java,py,js,ts,php,rb} .

The bug uses a fast RNG for a secret.

javascript

const token = Math.random().toString(36).slice(2);   // predictable
// use crypto.randomBytes(32).toString('hex')

Pro note: uuid1 encodes MAC and timestamp and is not secret; only uuid4 from a good source is acceptable, and even then not for high-value tokens. Confirm by checking entropy and whether tokens are sequential or time-correlated across a few samples.