#402 Weak PRNG in tracing.py for trace/span ID generation

closed medium Created 2025-12-12 05:49 · Updated 2025-12-12 05:55

Description

Edit
engine/utils/tracing.py:94,103 uses random.getrandbits() instead of secrets module for trace/span IDs. While not cryptographically sensitive, using weak PRNG could enable trace ID prediction in advanced attack scenarios. Fix: Use secrets.token_hex() instead.

Comments

Loading comments...

Context

Loading context...

Audit History

View All
Loading audit history...