From e78ede45b630897c3bd6000792f4855c363239a5 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Thu, 5 Mar 2026 08:41:44 -0300
Subject: [PATCH] Potential fix for code scanning alert no. 54: Insecure
 randomness

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 open-sse/services/accountSelector.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/open-sse/services/accountSelector.ts b/open-sse/services/accountSelector.ts
index a4eaef4e92..5d028e26e6 100644
--- a/open-sse/services/accountSelector.ts
+++ b/open-sse/services/accountSelector.ts
@@ -6,6 +6,7 @@
  */
 
 import { getAccountHealth } from "./accountFallback.ts";
+import crypto from "crypto";
 
 /**
  * P2C selection: pick 2 random candidates, return the healthier one.
@@ -19,9 +20,9 @@ export function selectAccountP2C(accounts, model = null) {
   if (!accounts || accounts.length === 0) return null;
   if (accounts.length === 1) return accounts[0];
 
-  // Pick 2 random distinct indices
-  const i = Math.floor(Math.random() * accounts.length);
-  let j = Math.floor(Math.random() * (accounts.length - 1));
+  // Pick 2 random distinct indices (cryptographically secure)
+  const i = crypto.randomInt(accounts.length);
+  let j = crypto.randomInt(accounts.length - 1);
   if (j >= i) j++; // Ensure distinct
 
   const a = accounts[i];
@@ -59,7 +60,7 @@ export function selectAccount(
 
     case "random":
       return {
-        account: accounts[Math.floor(Math.random() * accounts.length)],
+        account: accounts[crypto.randomInt(accounts.length)],
         state,
       };