Will It Vibe?Insecure math/rand for a security value in Go
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A file that imports math/rand uses rand.* on a line naming a token/secret/session/nonce. math/rand is deterministic; use crypto/rand instead. This is a proximity heuristic gated on the math/rand import.
Why it matters
Go's math/rand is deterministic and, even when seeded, is not safe for security values because its output is predictable. A token or key drawn from it can be guessed. This rule only fires when the file imports math/rand and a security word sits on the line, so it is a targeted heuristic.
How to fix it
Use crypto/rand for security values: crypto/rand.Read for raw bytes, or crypto/rand.Int for bounded integers. Reserve math/rand for simulations and load balancing where predictability is acceptable. Note that crypto/rand.Read returns an error you must check.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo