chore: 🐝 Update SDK - Generate [bump-api-version-to-v2025-11-15] 0.0.1 #46
BoostSecurity.io AI / boostsecurity - boostsecurityio/semgrep
succeeded
May 21, 2026 in 5m 19s
2 Security Findings
There are 2 newly introduced findings in this commit.
- To remediate findings follow the guidance in the annotations.
- To learn more about any finding visit the linked documentation.
- To mark any invalid finding as a False Positive, add a comment with
noboost.
Details
| Findings |
|---|
| CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Original Rule ID: python_random_rule-random Remediation: Consider using the secrets module instead when generating values forsecurity-sensitive operations. Recommended to use secrets.token_bytes() forraw bytes, secrets.token_hex() for hexadecimal strings, orsecrets.token_urlsafe() for URL-safe base64-encoded strings. For choosingrandom elements from a sequence, use secrets.choice(). The random moduleis appropriate only for non-security purposes like simulations, games, ortesting where predictability is acceptable.The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. The application uses the random module to generate random values. The randommodule implements a Mersenne Twister PRNG which is not cryptographically secure and produces predictable values that can be exploited when used for tokens, session... |
| 📘 Learn More |
| CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Original Rule ID: python_random_rule-random Remediation: Consider using the secrets module instead when generating values forsecurity-sensitive operations. Recommended to use secrets.token_bytes() forraw bytes, secrets.token_hex() for hexadecimal strings, orsecrets.token_urlsafe() for URL-safe base64-encoded strings. For choosingrandom elements from a sequence, use secrets.choice(). The random moduleis appropriate only for non-security purposes like simulations, games, ortesting where predictability is acceptable.The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. The application uses the random module to generate random values. The randommodule implements a Mersenne Twister PRNG which is not cryptographically secure and produces predictable values that can be exploited when used for tokens, session... |
| 📘 Learn More |
Annotations
boostsecurity-io-ai / boostsecurity - boostsecurityio/semgrep
gusto_app_int_v_2025_11_15/src/gusto_app_integration_v_2025_11_15/utils/retries.py#L122
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
boostsecurity-io-ai / boostsecurity - boostsecurityio/semgrep
gusto_embedded_v_2025_11_15/src/gusto_embedded_v_2025_11_15/utils/retries.py#L122
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Loading