From 7a3ebc30d3a11f64cc55ede513b93dd2174a3e46 Mon Sep 17 00:00:00 2001 From: Kaj Kowalski Date: Thu, 22 May 2025 07:40:24 +0200 Subject: [PATCH] Potential fix for code scanning alert no. 1: Insecure randomness Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- pages/api/dashboard/users.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pages/api/dashboard/users.ts b/pages/api/dashboard/users.ts index 48e04a1..6139d18 100644 --- a/pages/api/dashboard/users.ts +++ b/pages/api/dashboard/users.ts @@ -1,4 +1,5 @@ import { NextApiRequest, NextApiResponse } from "next"; +import crypto from "crypto"; import { getServerSession } from "next-auth"; import { prisma } from "../../../lib/prisma"; import bcrypt from "bcryptjs"; @@ -43,7 +44,7 @@ export default async function handler( return res.status(400).json({ error: "Missing fields" }); const exists = await prisma.user.findUnique({ where: { email } }); if (exists) return res.status(409).json({ error: "Email exists" }); - const tempPassword = Math.random().toString(36).slice(-8); // random initial password + const tempPassword = crypto.randomBytes(12).toString('base64').slice(0, 12); // secure random initial password await prisma.user.create({ data: { email,