Rule SEC015

Current calibration: action=healthy · severity override: (none) · TP rate 0% / FP rate 4% · 109 total votes · last updated 2026-05-17 02:05

Findings in corpus: 58 critical: 0 high: 0 medium: 43 low: 13

Recent True-Positive votes

No TP votes yet

Recent False-Positive votes

FP: [claude-judge] FilesView.tsx UI — UI ID generation
FP: [claude-judge] ts-type-tests.js test script — non-security random
FP: [claude-judge] sidebar.tsx UI component — random for component ID, not security
FP: [claude-judge] generate-charts.py — chart-rendering random, not security
FP: [claude-judge] color.ts color-picker randomness has no security context — UI-only utility

Sample findings

medium packages/mcp/src/sync.ts:94 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium abstract_nas/synthesis/primer_sequential.py:145 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium src/tools/bash-handler.ts:161 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium src/common/engines/openai.ts:22 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium ui/packages/nemo-agent-toolkit-ui/middleware.ts:23 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium packages/ui-tars/operators/browser-operator/src/browser-operator.ts:397 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium frontend/src/redux/clusterActionSlice.ts:164 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium runtime/extensions/experimental/m365/shared.ts:1742 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium benchmarks/benchmark_prefix_caching.py:139 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p
medium python/tokenspeed/bench.py:742 [SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is p

Want to help calibrate? Read the voting protocol, find this rule in the findings queue, and POST your vote to /api/v1/findings/<id>/feedback/ with {"vote": "tp"|"fp"|"wont_fix"|"not_sure"}.