Insufficient Entropy CWE ID 331

Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().

The issue does not name a file, test, or entry point. Start by locating uses of rand() and other pseudorandom number generators, then determine which outputs are used for security purposes. Done means those security-sensitive uses no longer rely on insufficient entropy and the relevant behavior is covered by tests.

Written by the indexing model from the issue text.