Deprecated/insecure crypto primitive
Part of the AI-generated code risks check · fix arrives as a pull request
What it is
The code uses a cryptographic primitive that is no longer considered safe — DES or 3DES, RC4, ECB mode, a static or zero IV, or Math.random() as a source of security-relevant values.
Why it matters
These fail in ways that do not look like failure. ECB leaks structure in ciphertext, a reused IV can expose the key stream, and Math.random() is predictable enough to guess tokens generated near a known one.
How to fix it
Use AES-256-GCM with a fresh random IV per message, and crypto.randomBytes() (or crypto.getRandomValues()) for anything a user should not be able to predict. Prefer a vetted library over assembling primitives by hand.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.