For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Applies when

The project it has user accounts.

How to do it

Use crypto.randomBytes or crypto.randomUUID in Node, the secrets module in Python, random_bytes in PHP, SecureRandom in Java and Ruby, and crypto/rand in Go. Plain generators such as Math.random are fast but predictable, so an attacker who sees a few values can work out the next. API keys also follow Store API keys as hashes. Make each token as long as Lock down session cookies says. Links in email also follow single-use and short-lived links.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

import { randomBytes } from 'node:crypto';

// Bad: predictable
const resetCode = Math.random().toString(36).slice(2);
// Good
const resetToken = randomBytes(32).toString('base64url');

Python example

import secrets

# Bad: predictable
reset_code = str(random.randint(100000, 999999))
# Good
reset_token = secrets.token_urlsafe(32)

How to check

Search the code for Math.random, random.random, random.choice, mt_rand, uniqid and math/rand. No match makes a token, code or ID that grants access.

Sources

• OWASP Cryptographic Storage Cheat Sheet on secure random numbers

Related rules

• Store API keys as hashes in API design
• Lock down session cookies in Security testing
• Make sign-in and reset links single-use and short-lived in Email