vetkit.java.crypto.predictable-secure-random-seed

SecureRandom is seeded with a constant value, which can make its output predictable.

Last updated: 2026-11-01

Suite: Security

java

SecureRandom is seeded with a constant value, which can make its output predictable.

Category: SECURITY · Engine rule severity: WARNING

How to fix it

Do not seed SecureRandom yourself; let the provider seed itself from the OS (with SHA1PRNG an early constant seed makes the whole output stream deterministic).

References

https://cwe.mitre.org/data/definitions/336.html

Source: packages/engine/rules/sast/java.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.