Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/pyx3-0.15/pyx/pykpathsea.c Examining data/pyx3-0.15/pyx/font/_t1code.c FINAL RESULTS: data/pyx3-0.15/pyx/font/_t1code.c:76:20: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. unsigned char *random; data/pyx3-0.15/pyx/font/_t1code.c:79:82: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. if (PyArg_ParseTuple(args, "y#iy#", (char **) &data, &ldata, &pr, (char **) &random, &lrandom)) { data/pyx3-0.15/pyx/font/_t1code.c:89:19: [3] (random) random: This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327). Use a more secure technique for acquiring random values. code[i] = random[i] ^ ( r >> 8); ANALYSIS SUMMARY: Hits = 3 Lines analyzed = 249 in approximately 0.08 seconds (3190 lines/second) Physical Source Lines of Code (SLOC) = 127 Hits@level = [0] 0 [1] 0 [2] 0 [3] 3 [4] 0 [5] 0 Hits@level+ = [0+] 3 [1+] 3 [2+] 3 [3+] 3 [4+] 0 [5+] 0 Hits/KSLOC@level+ = [0+] 23.622 [1+] 23.622 [2+] 23.622 [3+] 23.622 [4+] 0 [5+] 0 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.