// [CRUCIBLE-SEED]
// category: insecure_crypto
// severity: high
// language: java
// expected: java.util.Random used for security token generation instead of SecureRandom

import java.util.Random;

public class TokenGenerator {
    // Vulnerable: java.util.Random is not cryptographically secure
    private static final Random RANDOM = new Random();
    private static final String CHARS  = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";

    public static String generateSessionToken(int length) {
        StringBuilder sb = new StringBuilder(length);
        for (int i = 0; i < length; i++) {
            sb.append(CHARS.charAt(RANDOM.nextInt(CHARS.length())));
        }
        return sb.toString();
    }

    public static String generatePasswordResetToken() {
        return generateSessionToken(32);
    }
}