Skip to content

suspicious-non-cryptographic-random-usage (S311)

Derived from the flake8-bandit linter.

What it does

Checks for uses of cryptographically weak pseudo-random number generators.

Why is this bad?

Cryptographically weak pseudo-random number generators are insecure, as they are easily predictable. This can allow an attacker to guess the generated numbers and compromise the security of the system.

Instead, use a cryptographically secure pseudo-random number generator (such as using the secrets module) when generating random numbers for security purposes.

Example

import random

random.randrange(10)

Use instead:

import secrets

secrets.randbelow(10)

References