jonschlinkert / randomatic

Easily generate random strings like passwords, with simple options for specifying a length and for using patterns of numeric, alpha-numeric, alphabetical, special or custom characters. (the original "generate-password")
https://github.com/jonschlinkert
MIT License
183 stars 25 forks source link

There is no vulnerability #26

Open jonschlinkert opened 5 years ago

jonschlinkert commented 5 years ago

For those who have seen the "vulnerability" report

There is no vulnerability in randomatic, and there never was.

  1. randomatic, long ago, was used for generating pseudo-random strings for unit tests and temp directory names.
  2. later, we added support for cryptographically secure random strings. At that point, we said it could be used for passwords. It was a major bump.
  3. then, much later, someone mistakenly assumed that randomatic was previously advertised as a password generator, which it was not, and they wanted to receive a bounty from snyk or something so they reported randomatic as having a vulnerability.

We have asked the individual who created the report to close it or remove it. They won't. Please don't complain here, or on other libraries that use this. Your time would be much better served making those same complaints on NPM or Snyk, to ask them to close that issue.