highConfiguration

Weak Randomness or Hashing for Security Values

A security value is generated or protected with a method that is easy to predict or reverse.

Why it matters

Math.random is designed for games and animations, not secrets, and its output can be predicted. MD5 and SHA-1 are fast, which is exactly wrong for passwords. A JWT that is decoded but not verified can be edited by whoever holds it. Node ships proper tools for all three.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Reset token from Math.random
const resetToken = Math.random().toString(36).slice(2);

The smallest fix

minimal patch
import { randomBytes, randomInt } from 'node:crypto';
const resetToken = randomBytes(32).toString('hex');   // tokens
const otp = String(randomInt(0, 1_000_000)).padStart(6, '0'); // codes

import bcrypt from 'bcrypt';
const passwordHash = await bcrypt.hash(password, 12); // passwords

const payload = jwt.verify(token, secret, { algorithms: ['HS256'] }); // never decode() for auth

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number]: [the flagged code]. Replace Math.random with crypto.randomBytes or crypto.randomInt for anything security related, replace MD5/SHA-1 password hashing with bcrypt or argon2, use at least 32 random bytes for tokens, and use jwt.verify with an explicit algorithms list instead of jwt.decode when deciding who a user is.

How to check the fix worked

1. Generate a few tokens and confirm they are 64 hex characters and never
   repeat.
2. For passwords, confirm the stored value starts with $2b$ (bcrypt) or
   $argon2.
3. For JWTs, alter one character of a token and confirm it is rejected.

Further reading