Catch insecure randomness for security tokens
Session ids, reset tokens, and API keys generated from non-cryptographic RNGs are predictable.
Tag: crypto
Flag weak cryptography and password hashing
MD5 or SHA1 for passwords, ECB mode, and static IVs are review red flags that indicate broader crypto misuse.