@anonympins/fingerprint 0.5.1 → 0.5.2

package/src/js/fingerprint.utils.js

@@ -1,184 +1,214 @@
-import {cyrb53} from "./fingerprint.builder.js";
-
-export function verifyZkpProof(yStr, tStr, sStr) {
-    try {
-        const y = BigInt('0x' + yStr);
-        const t = BigInt('0x' + tStr);
-        const s = BigInt('0x' + sStr);
-
-        const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
-        const ZKP_G = 2n;
-
-        const cStr = ZKP_G.toString() + y.toString() + t.toString();
-        const hashHex = crypto.createHash('sha256').update(cStr).digest('hex');
-        const c = BigInt('0x' + hashHex) % ZKP_P;
-
-        return modPow(ZKP_G, s, ZKP_P) === (t * modPow(y, c, ZKP_P)) % ZKP_P;
-    } catch (e) {
-        return false;
-    }
-}
-
-export function decodePolymorphicFingerprint(fpString, mapping) {
-    if (!fpString || !mapping || !mapping.keys) return fpString;
-    const reverseKeys = {};
-    for (const [orig, rand] of Object.entries(mapping.keys)) {
-        reverseKeys[rand] = orig;
-    }
-    const parts = fpString.split('|');
-    const mappedParts = parts.map(part => {
-        const pair = part.split(':');
-        if (pair.length === 2) {
-            const origKey = reverseKeys[pair[0]] || pair[0];
-            return `${origKey}:${pair[1]}`;
-        }
-        return part;
-    });
-    return mappedParts.join('|');
-}
-
-
-/**
- * @private
- * Deep merges two objects. The `source` object's properties overwrite the `target`'s.
- * @param {object} target - The target object.
- * @param {object} source - The source object.
- * @returns {object} The merged object.
- */
-export function deepMerge(target, source) {
-    const output = { ...target };
-    if (target && typeof target === 'object' && source && typeof source === 'object') {
-        Object.keys(source).forEach(key => {
-            if (source[key] && typeof source[key] === 'object' && key in target) {
-                output[key] = deepMerge(target[key], source[key]);
-            } else {
-                output[key] = source[key];
-            }
-        });
-    }
-    return output;
-}
-
-/**
- * Creates a stable hash based on device characteristics, independent of the IP.
- * This is our "level 2 fingerprint".
- * @param {object} context - The request context.
- * @returns {string} A hash representing the device.
- */
-export function getHeaderSignature(context) {
-    if (!context.rawHeaders) return '';
-    const headerKeys = [];
-    for (let i = 0; i < context.rawHeaders.length; i += 2) {
-        headerKeys.push(context.rawHeaders[i]);
-    }
-    return cyrb53(headerKeys.sort().join(','));
-}
-
-/**
- * Analyses a raw JA3 string.
- * Format: "TLSVersion,Ciphers,Extensions,EllipticCurves,EllipticCurveFormats"
- * @param {string} ja3String
- * @returns {object|null}
- */
-export function parseJa3(ja3String) {
-    if (!ja3String || typeof ja3String !== 'string') {
-        return null;
-    }
-    const parts = ja3String.split(',');
-    if (parts.length !== 5) {
-        return null;
-    }
-    return {
-        tlsVersion: parseInt(parts[0], 10),
-        ciphers: parts[1] !== '' ? parts[1].split('-').map(Number) : [],
-        extensions: parts[2] !== '' ? parts[2].split('-').map(Number) : [],
-        curves: parts[3] !== '' ? parts[3].split('-').map(Number) : [],
-        points: parts[4] !== '' ? parts[4].split('-').map(Number) : []
-    };
-}
-
-export function modPow(base, exponent, modulus) {
-    if (modulus === 1n) return 0n;
-    let result = 1n;
-    base = base % modulus;
-    while (exponent > 0n) {
-        if (exponent % 2n === 1n) {
-            result = (result * base) % modulus;
-        }
-        exponent = exponent >> 1n;
-        base = (base * base) % modulus;
-    }
-    return result;
-}
-
-
-export function hashNetwork(ip, prefix = 24) {
-    // Hash du réseau (masque /24 ou /16)
-    const parts = ip.split('.');
-    if (parts.length !== 4) return null;
-    const maskBytes = prefix / 8;
-    const network = parts.slice(0, maskBytes).join('.');
-    // Hash simple
-    let hash = 0;
-    for (let i = 0; i < network.length; i++) {
-        const char = network.charCodeAt(i);
-        hash = ((hash << 5) - hash) + char;
-        hash = hash & hash;
-    }
-    return hash.toString(16);
-}
-export function normalizeReferer(referer) {
-    try {
-        const url = new URL(referer);
-        return `${url.protocol}//${url.hostname}`;
-    } catch {
-        return referer;
-    }
-}
-
-export function isPrivateIp(ip) {
-    // Vérifier si l'IP est privée
-    const parts = ip.split('.');
-    if (parts.length !== 4) return false;
-    const first = parseInt(parts[0]);
-    return (first === 10) || (first === 172 && parseInt(parts[1]) >= 16 && parseInt(parts[1]) <= 31) || (first === 192 && parseInt(parts[1]) === 168);
-}
-// Fonctions utilitaires
-export function parseUserAgent(ua) {
-    // Parser basique du User-Agent
-    const result = {};
-
-    // Détection du navigateur
-    if (ua.includes('Chrome') && !ua.includes('Edg')) {
-        result.browser = 'Chrome';
-        const match = ua.match(/Chrome\/(\d+)/);
-        if (match) result.browser += `/${match[1]}`;
-    } else if (ua.includes('Firefox')) {
-        result.browser = 'Firefox';
-        const match = ua.match(/Firefox\/(\d+)/);
-        if (match) result.browser += `/${match[1]}`;
-    } else if (ua.includes('Safari') && !ua.includes('Chrome')) {
-        result.browser = 'Safari';
-        const match = ua.match(/Version\/(\d+)/);
-        if (match) result.browser += `/${match[1]}`;
-    } else if (ua.includes('Edg')) {
-        result.browser = 'Edge';
-        const match = ua.match(/Edg\/(\d+)/);
-        if (match) result.browser += `/${match[1]}`;
-    }
-
-    // Détection de l'OS
-    if (ua.includes('Windows NT 10.0')) result.os = 'Windows 10';
-    else if (ua.includes('Windows NT 6.1')) result.os = 'Windows 7';
-    else if (ua.includes('Mac OS X')) result.os = 'macOS';
-    else if (ua.includes('Linux') && !ua.includes('Android')) result.os = 'Linux';
-    else if (ua.includes('Android')) result.os = 'Android';
-    else if (ua.includes('iPhone') || ua.includes('iPad')) result.os = 'iOS';
-
-    // Détection du type d'appareil
-    if (ua.includes('Mobile')) result.device = 'mobile';
-    else if (ua.includes('Tablet')) result.device = 'tablet';
-    else result.device = 'desktop';
-
-    return result;
+import {cyrb53} from "./fingerprint.builder.js";
+
+export function verifyZkpProof(yStr, tStr, sStr) {
+    try {
+        const y = BigInt('0x' + yStr);
+        const t = BigInt('0x' + tStr);
+        const s = BigInt('0x' + sStr);
+
+        const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
+        const ZKP_G = 2n;
+
+        const cStr = ZKP_G.toString() + y.toString() + t.toString();
+        const hashHex = crypto.createHash('sha256').update(cStr).digest('hex');
+        const c = BigInt('0x' + hashHex) % ZKP_P;
+
+        return modPow(ZKP_G, s, ZKP_P) === (t * modPow(y, c, ZKP_P)) % ZKP_P;
+    } catch (e) {
+        return false;
+    }
+}
+
+export function safeJsonStringify(val) {
+    return JSON.stringify(val)
+        .replace(/</g, '\\u003c')
+        .replace(/>/g, '\\u003e')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
+
+export function sanitizeRedirectPath(p) {
+    if (typeof p !== 'string') return '/';
+    let sanitized = p.replace(/[^a-zA-Z0-9\/.\-_~%?&=:@+,;]/g, '');
+
+    // Prevent protocol-relative redirects (e.g. //evil.com)
+    if (sanitized.startsWith('//')) {
+        sanitized = '/' + sanitized.replace(/^\/+/g, '');
+    }
+    // Prevent absolute redirects (e.g. http://evil.com)
+    if (/^https?:\/\//i.test(sanitized)) {
+        try {
+            const parsed = new URL(sanitized);
+            sanitized = parsed.pathname + parsed.search + parsed.hash;
+        } catch (e) {
+            sanitized = '/';
+        }
+    }
+    if (!sanitized.startsWith('/')) {
+        sanitized = '/' + sanitized;
+    }
+    return sanitized.replace(/^\/+/g, '/');
+}
+export function decodePolymorphicFingerprint(fpString, mapping) {
+    if (!fpString || !mapping || !mapping.keys) return fpString;
+    const reverseKeys = {};
+    for (const [orig, rand] of Object.entries(mapping.keys)) {
+        reverseKeys[rand] = orig;
+    }
+    const parts = fpString.split('|');
+    const mappedParts = parts.map(part => {
+        const pair = part.split(':');
+        if (pair.length === 2) {
+            const origKey = reverseKeys[pair[0]] || pair[0];
+            return `${origKey}:${pair[1]}`;
+        }
+        return part;
+    });
+    return mappedParts.join('|');
+}
+
+
+/**
+ * @private
+ * Deep merges two objects. The `source` object's properties overwrite the `target`'s.
+ * @param {object} target - The target object.
+ * @param {object} source - The source object.
+ * @returns {object} The merged object.
+ */
+export function deepMerge(target, source) {
+    const output = { ...target };
+    if (target && typeof target === 'object' && source && typeof source === 'object') {
+        Object.keys(source).forEach(key => {
+            if (source[key] && typeof source[key] === 'object' && key in target) {
+                output[key] = deepMerge(target[key], source[key]);
+            } else {
+                output[key] = source[key];
+            }
+        });
+    }
+    return output;
+}
+
+/**
+ * Creates a stable hash based on device characteristics, independent of the IP.
+ * This is our "level 2 fingerprint".
+ * @param {object} context - The request context.
+ * @returns {string} A hash representing the device.
+ */
+export function getHeaderSignature(context) {
+    if (!context.rawHeaders) return '';
+    const headerKeys = [];
+    for (let i = 0; i < context.rawHeaders.length; i += 2) {
+        headerKeys.push(context.rawHeaders[i]);
+    }
+    return cyrb53(headerKeys.sort().join(','));
+}
+
+/**
+ * Analyses a raw JA3 string.
+ * Format: "TLSVersion,Ciphers,Extensions,EllipticCurves,EllipticCurveFormats"
+ * @param {string} ja3String
+ * @returns {object|null}
+ */
+export function parseJa3(ja3String) {
+    if (!ja3String || typeof ja3String !== 'string') {
+        return null;
+    }
+    const parts = ja3String.split(',');
+    if (parts.length !== 5) {
+        return null;
+    }
+    return {
+        tlsVersion: parseInt(parts[0], 10),
+        ciphers: parts[1] !== '' ? parts[1].split('-').map(Number) : [],
+        extensions: parts[2] !== '' ? parts[2].split('-').map(Number) : [],
+        curves: parts[3] !== '' ? parts[3].split('-').map(Number) : [],
+        points: parts[4] !== '' ? parts[4].split('-').map(Number) : []
+    };
+}
+
+export function modPow(base, exponent, modulus) {
+    if (modulus === 1n) return 0n;
+    let result = 1n;
+    base = base % modulus;
+    while (exponent > 0n) {
+        if (exponent % 2n === 1n) {
+            result = (result * base) % modulus;
+        }
+        exponent = exponent >> 1n;
+        base = (base * base) % modulus;
+    }
+    return result;
+}
+
+
+export function hashNetwork(ip, prefix = 24) {
+    // Hash du réseau (masque /24 ou /16)
+    const parts = ip.split('.');
+    if (parts.length !== 4) return null;
+    const maskBytes = prefix / 8;
+    const network = parts.slice(0, maskBytes).join('.');
+    // Hash simple
+    let hash = 0;
+    for (let i = 0; i < network.length; i++) {
+        const char = network.charCodeAt(i);
+        hash = ((hash << 5) - hash) + char;
+        hash = hash & hash;
+    }
+    return hash.toString(16);
+}
+export function normalizeReferer(referer) {
+    try {
+        const url = new URL(referer);
+        return `${url.protocol}//${url.hostname}`;
+    } catch {
+        return referer;
+    }
+}
+
+export function isPrivateIp(ip) {
+    // Vérifier si l'IP est privée
+    const parts = ip.split('.');
+    if (parts.length !== 4) return false;
+    const first = parseInt(parts[0]);
+    return (first === 10) || (first === 172 && parseInt(parts[1]) >= 16 && parseInt(parts[1]) <= 31) || (first === 192 && parseInt(parts[1]) === 168);
+}
+// Fonctions utilitaires
+export function parseUserAgent(ua) {
+    // Parser basique du User-Agent
+    const result = {};
+
+    // Détection du navigateur
+    if (ua.includes('Chrome') && !ua.includes('Edg')) {
+        result.browser = 'Chrome';
+        const match = ua.match(/Chrome\/(\d+)/);
+        if (match) result.browser += `/${match[1]}`;
+    } else if (ua.includes('Firefox')) {
+        result.browser = 'Firefox';
+        const match = ua.match(/Firefox\/(\d+)/);
+        if (match) result.browser += `/${match[1]}`;
+    } else if (ua.includes('Safari') && !ua.includes('Chrome')) {
+        result.browser = 'Safari';
+        const match = ua.match(/Version\/(\d+)/);
+        if (match) result.browser += `/${match[1]}`;
+    } else if (ua.includes('Edg')) {
+        result.browser = 'Edge';
+        const match = ua.match(/Edg\/(\d+)/);
+        if (match) result.browser += `/${match[1]}`;
+    }
+
+    // Détection de l'OS
+    if (ua.includes('Windows NT 10.0')) result.os = 'Windows 10';
+    else if (ua.includes('Windows NT 6.1')) result.os = 'Windows 7';
+    else if (ua.includes('Mac OS X')) result.os = 'macOS';
+    else if (ua.includes('Linux') && !ua.includes('Android')) result.os = 'Linux';
+    else if (ua.includes('Android')) result.os = 'Android';
+    else if (ua.includes('iPhone') || ua.includes('iPad')) result.os = 'iOS';
+
+    // Détection du type d'appareil
+    if (ua.includes('Mobile')) result.device = 'mobile';
+    else if (ua.includes('Tablet')) result.device = 'tablet';
+    else result.device = 'desktop';
+
+    return result;
 }

package/src/js/gpu_pow.solver.js

@@ -24,6 +24,7 @@ export class GpuPowSolver {
             }
         } catch (e) {
             console.warn('[GPU-PoW] WebGPU failed or disabled, falling back to WebGL2:', e);
+            // Fallthrough to WebGL2
         }
 
         // Fallback to WebGL2
@@ -35,7 +36,20 @@ export class GpuPowSolver {
                 duration: performance.now() - start
             };
         } catch (e) {
-            throw new Error(`[GPU-PoW] Both WebGPU and WebGL2 solvers failed: ${e.message}`);
+            console.warn('[GPU-PoW] WebGL2 failed or disabled, falling back to WebGL1:', e);
+            // Fallthrough to WebGL1
+        }
+
+        // Fallback to WebGL1
+        try {
+            const result = await this._solveWebGL1(numericSeed, iterations);
+            return {
+                solution: result,
+                platform: 'webgl1',
+                duration: performance.now() - start
+            };
+        } catch (e) {
+            throw new Error(`[GPU-PoW] All GPU solvers (WebGPU, WebGL2, WebGL1) failed: ${e.message}`);
         }
     }
 
@@ -200,6 +214,87 @@ export class GpuPowSolver {
         return result.map(v => v.toFixed(6)).join(',');
     }
 
+    static async _solveWebGL1(seed, iterations) {
+        const canvas = document.createElement('canvas');
+        canvas.width = 8;
+        canvas.height = 8; // 64 pixels total matching WebGPU size
+        const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl'); // Get WebGL1 context with legacy fallback
+        if (!gl) throw new Error('WebGL1 context not supported.');
+
+        // WebGL1 Vertex Shader
+        const vs = `
+            attribute vec4 pos;
+            void main() {
+                gl_Position = pos;
+            }`;
+        // WebGL1 Fragment Shader
+        const fs = `
+            precision highp float; // highp float is an extension in WebGL1, but generally available
+            uniform float uSeed;
+            uniform int uIterations;
+            void main() {
+                float index = gl_FragCoord.x + (gl_FragCoord.y * 8.0);
+                float x = uSeed + (index * 0.015);
+                float r = 3.9999;
+                for(int i = 0; i < uIterations; i++) {
+                    x = r * x * (1.0 - x);
+                }
+                gl_FragColor = vec4(x, 0.0, 0.0, 1.0); // Use gl_FragColor for WebGL1
+            }`;
+
+        const program = this._createProgram(gl, vs, fs);
+        gl.useProgram(program);
+
+        const posAttr = gl.getAttribLocation(program, 'pos');
+        const buffer = gl.createBuffer();
+        gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
+        gl.bufferData(gl.ARRAY_BUFFER, new Float32Array([-1,-1, 1,-1, -1,1, -1,1, 1,-1, 1,1]), gl.STATIC_DRAW);
+        gl.enableVertexAttribArray(posAttr);
+        gl.vertexAttribPointer(posAttr, 2, gl.FLOAT, false, 0, 0);
+
+        gl.uniform1f(gl.getUniformLocation(program, 'uSeed'), seed);
+        gl.uniform1i(gl.getUniformLocation(program, 'uIterations'), iterations);
+
+        // Check for OES_texture_float and WEBGL_color_buffer_float extensions for float textures and readPixels
+        const floatTextureExt = gl.getExtension('OES_texture_float');
+        const floatColorBufferExt = gl.getExtension('WEBGL_color_buffer_float');
+
+        if (!floatTextureExt || !floatColorBufferExt) {
+            throw new Error('WebGL1 float texture/color buffer extensions not supported. Cannot read float pixels.');
+        }
+
+        // Create a framebuffer to render to a float texture
+        const texture = gl.createTexture();
+        gl.bindTexture(gl.TEXTURE_2D, texture);
+        gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, canvas.width, canvas.height, 0, gl.RGBA, gl.FLOAT, null);
+        gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.NEAREST);
+        gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.NEAREST);
+        gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_S, gl.CLAMP_TO_EDGE);
+        gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_T, gl.CLAMP_TO_EDGE);
+
+        const fb = gl.createFramebuffer();
+        gl.bindFramebuffer(gl.FRAMEBUFFER, fb);
+        gl.framebufferTexture2D(gl.FRAMEBUFFER, gl.COLOR_ATTACHMENT0, gl.TEXTURE_2D, texture, 0);
+
+        const status = gl.checkFramebufferStatus(gl.FRAMEBUFFER);
+        if (status !== gl.FRAMEBUFFER_COMPLETE) {
+            throw new Error('WebGL1 framebuffer not complete: ' + status);
+        }
+
+        gl.viewport(0, 0, canvas.width, canvas.height);
+        gl.drawArrays(gl.TRIANGLES, 0, 6);
+
+        const pixels = new Float32Array(canvas.width * canvas.height * 4);
+        gl.readPixels(0, 0, canvas.width, canvas.height, gl.RGBA, gl.FLOAT, pixels);
+
+        const result = [];
+        for (let i = 0; i < 64; i++) {
+            result.push(pixels[i * 4]); // Only take the R component
+        }
+
+        return result.map(v => v.toFixed(6)).join(',');
+    }
+
     static _createProgram(gl, vsSource, fsSource) {
         const vs = gl.createShader(gl.VERTEX_SHADER);
         gl.shaderSource(vs, vsSource);

package/src/js/library.js

@@ -521,8 +521,8 @@ Optimization.geneticAlgorithmMultiObjective = function (
     const offspring = [];
     for (let i = 0; i < populationSize; i++) {
       // Sélection simple pour l'exemple
-      const parent1 = population[Math.floor(secureRandom() * population.length)];
-      const parent2 = population[Math.floor(secureRandom() * population.length)];
+        const parent1 = population[crypto.randomInt(0, population.length)];
+        const parent2 = population[crypto.randomInt(0, population.length)];
       let childIndividual = crossover(parent1.individual, parent2.individual);
       if (secureRandom() < mutationRate) {
         childIndividual = mutate(childIndividual, currentConfig); // mutate doit maintenant utiliser currentConfig
@@ -749,7 +749,7 @@ Optimization.Operators.createTournamentSelection = (options = {}) => {
 
     for (let i = 0; i < tournamentSize; i++) {
       const individual =
-        population[Math.floor(secureRandom() * population.length)];
+        population[crypto.randomInt(0, population.length)];
       if (!best || individual.fitness < best.fitness) {
         best = individual;
       }
@@ -757,7 +757,7 @@ Optimization.Operators.createTournamentSelection = (options = {}) => {
     // Retourne le meilleur trouvé. Dans le pire des cas (tous les scores sont Infinity),
     // on retourne le premier candidat sélectionné au lieu de null.
     if (!best) {
-      return population[Math.floor(secureRandom() * population.length)];
+      return population[crypto.randomInt(0, population.length)];
     }
     return best;
   };
@@ -911,9 +911,12 @@ Optimization.Operators.solveTSP = (cities, options = {}) => {
   // Voisinage : génère un chemin voisin en inversant une sous-séquence (heuristique 2-opt).
   const pathNeighbor = (path) => {
     const newPath = [...path];
-    let i = Math.floor(secureRandom() * newPath.length);
-    let j = Math.floor(secureRandom() * newPath.length);
-    if (i === j) j = (j + 1) % newPath.length;
+    if (newPath.length <= 1) return newPath;
+    let i = crypto.randomInt(0, newPath.length);
+    let j = crypto.randomInt(0, newPath.length);
+    while (i === j) {
+      j = crypto.randomInt(0, newPath.length);
+    }
     const [start, end] = [Math.min(i, j), Math.max(i, j)];
 
     const segment = newPath.slice(start, end + 1).reverse();
@@ -971,7 +974,7 @@ Optimization.Operators.solvePortfolio = (
 
   const mutate = (p) => {
     const newP = [...p];
-    const i = Math.floor(secureRandom() * newP.length);
+      const i = crypto.randomInt(0, newP.length);
     newP[i] += (secureRandom() - 0.5) * 0.2; // Mutation douce
     newP[i] = Math.max(0, newP[i]); // Les poids ne peuvent être négatifs
     return newP;
@@ -1105,7 +1108,7 @@ Optimization.Operators.solveFacilityLocation = (
   // Voisinage : déplace légèrement une infrastructure au hasard.
   const facilityNeighbor = (facilities) => {
     const newFacilities = facilities.map((f) => ({ ...f }));
-    const i = Math.floor(secureRandom() * numFacilities);
+      const i = crypto.randomInt(0, numFacilities);
     const moveX = (secureRandom() - 0.5) * (bounds.maxX - bounds.minX) * 0.1;
     const moveY = (secureRandom() - 0.5) * (bounds.maxY - bounds.minY) * 0.1;
 
@@ -1485,7 +1488,7 @@ Optimization.Operators.solveFraudDetection = (context, options = {}) => {
     const minTimeToClick = 100 + secureRandom() * 4900; // entre 100ms et 5s
     const maxClickVariance = 1 + secureRandom() * 9999; // entre 1 et 10000
     const minMouseEntropy = secureRandom() * 0.5; // entre 0 et 0.5
-    const minScrollEvents = Math.floor(secureRandom() * 10); // entre 0 et 10
+    const minScrollEvents = crypto.randomInt(0, 10); // entre 0 et 10
     return [minTimeToClick, maxClickVariance, minMouseEntropy, minScrollEvents];
   };
 
@@ -1502,7 +1505,7 @@ Optimization.Operators.solveFraudDetection = (context, options = {}) => {
   // Mutation : légère variation aléatoire d'un des seuils
   const mutate = (solution) => {
     const newSolution = [...solution];
-    const i = Math.floor(secureRandom() * 4);
+    const i = crypto.randomInt(0, 4);
     // Amplitudes de mutation différentes pour chaque seuil
     const mutationFactors = [500, 1000, 0.1, 2];
     const mutationFactor = mutationFactors[i];
@@ -1646,7 +1649,7 @@ Optimization.Operators.solveFullSecurityTuning = (context, options = {}) => {
             burstWeight: 20 + secureRandom() * 40,
             scrapeThreshold: 500 + secureRandom() * 1000,
             scrapeWeight: 15 + secureRandom() * 35,
-            sequenceLength: 3 + Math.floor(secureRandom() * 3),
+            sequenceLength: 3 + crypto.randomInt(0, 3),
             sequenceWeight: 20 + secureRandom() * 50,
             regularityThreshold: 50 + secureRandom() * 200,
             regularityWeight: 20 + secureRandom() * 40,
@@ -1696,7 +1699,7 @@ Optimization.Operators.solveFullSecurityTuning = (context, options = {}) => {
         }
 
         const keys = Object.keys(newConfig[sectionToMutate]);
-        const keyToMutate = keys[Math.floor(secureRandom() * keys.length)];
+        const keyToMutate = keys[crypto.randomInt(0, keys.length)];
 
         if (keyToMutate === 'honeypotScore') return newConfig; // Ne pas muter le poids du honeypot