0 vulnerabilities found in Android library project

[insidersec]

0 vulnerabilities found in Android library project

[malenalbc]

@omatron Might be because I was using the kotlin wrapper so the import was actually kotlin.random.Random. I'd add that one as a Kotlin rule as it's the same vulnerability.

[omatron]

Hello @malenalbc, thank you very much for reporting, we are currently working on improvements for the ruleset and the way insider analyzes, meanwhile, we have the enterprise version with 2 free analysis if want to check it out: https://console.insidersec.io/en/register.

[malenalbc]

Hello @omatron Thanks for your answer. Just tried the enterprise version and it didn't report the vulnerability either. Will check the tool back on next updates. Closing this.

[omatron]

@malenalbc Thank you for trying the enterprise, it's very strange because we have the rules for the java.util.Random, we will investigate further.

The expected result is:
The application uses a predictable, therefore insecure, random number generator.

Instances of java.util.Random are not cryptographically secure. Consider instead using SecureRandom to get a cryptographically secure pseudo-random number generator for use by security-sensitive applications.

Thanks again for taking the time to evaluate!