Prep RoomSign inStart free
Code RoomSession token uses non-cryptographic RNG
HardPrep Room Coding #3993

Session token uses non-cryptographic RNG

Vibe & agenticSecuritySenior–Staff~18 min

An AI agent wrote this Rust function to generate a session token, using a method on the rand crate it claimed produces 'cryptographically secure' bytes. It compiles after the AI adjusted the import. Review it for a production auth system.

Implement
token_entropy_bits(alphabet: str, length: int) → float
Examples
in["abcdefghijklmnopqrstuvwxyz",16]out75.20703549025747
in["0123456789abcdef",32]out128
in["abcabc",10]out15.849625007211563
What a strong answer looks like

Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it (tests, edge cases, reading critically), and how you’d re-prompt or decompose to get it right.

0:00 of about 18 min

Vibe & agentic: describe the solution in plain language (or narrate it) and the coach grades your approach.

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.