Commit activity
Last 12 weeks · 1 commit
Community health
2 of 6 standards met
50
✓README✓License○Contributing○Code of Conduct○Issue Template○PR Template
Recent fixes
Summary Fix an off-by-one error in the rejection sampling algorithm that causes character to appear ~25% more often than any other character. Finding: Rejection Sampling Bias (Low) File: , line 28 Issue: The rejection threshold is , but should be (or equivalently ). Character set size: 62 chars → values 0-247 (248 values) are evenly divisible by 62 = 4 mappings per char Value 248 also passes the filter ( is ) and maps to index → So gets 5 mappings vs 4 for all other characters = 25% relative bias Fix Changed to . Verification ✅ All existing tests pass () ✅ 62-char charset: , correct threshold is or Related CWE-330: Use of Insufficiently Random Values 🔒 Security Note for Vercel Security Team This PR fixes a cryptographic bias in uid generation. This finding may be eligible for the Vercel Open Source Bug Bounty Program (Tier 1: $200–$10,000). Ref: https://hackerone.com/vercel-open-source
Removed pull_request_target event from workflow.
Reverts vercel/uid-promise#35 since node 16 is EOL
Structured data for AI agents
Repository: vercel/uid-promise. Description: Creates a cryptographically strong UID Stars: 262, Forks: 15. Primary language: TypeScript. Languages: TypeScript (53.6%), JavaScript (46.4%). License: MIT. Homepage: https://npmjs.com/uid-promise Topics: guid, uid, uuid. Latest release: 2.0.5 (3y ago). Open PRs: 0, open issues: 0. Last activity: 2mo ago. Community health: 50%. Top contributors: leo, greenkeeperio-bot, styfle, agadzik, rauchg, rickycodes, leerob, mrmckeb, jfmengels, lucleray and others.