chore: code quality feedback for 2.9.16 (#1754)

* code quality feedback

* agent feedback

.github/workflows/kmp-ci.yml

@@ -1,5 +1,8 @@
 name: KMP CI
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths: ["packages/kmp-sdk/**", "packages/kmp-test-app/**"]

packages/mobile-sdk-alpha/src/mock/generator.ts

@@ -54,11 +54,12 @@ export async function generateMockDocument({
   lastName,
 }: GenerateMockDocumentOptions): Promise<PassportData | AadhaarData> {
   console.log('generateMockDocument received names:', { firstName, lastName, isInOfacList });
-  const randomPassportNumber = Math.random()
-    .toString(36)
-    .substring(2, 11)
-    .replace(/[^a-z0-9]/gi, '')
-    .toUpperCase();
+  const ALPHANUMERIC = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+  const randomBytes = new Uint8Array(9);
+  crypto.getRandomValues(randomBytes);
+  const randomPassportNumber = Array.from(randomBytes)
+    .map(b => ALPHANUMERIC[b % ALPHANUMERIC.length])
+    .join('');
   const [dgHashAlgo, eContentHashAlgo, signatureTypeForGeneration] =
     signatureAlgorithmToStrictSignatureAlgorithm[
       selectedAlgorithm as keyof typeof signatureAlgorithmToStrictSignatureAlgorithm

packages/mobile-sdk-alpha/src/processing/mrz.ts

@@ -308,11 +308,11 @@ export function extractNameFromMRZ(mrzString: string): { firstName: string; last
       const parts = namePart.split('<<').filter(Boolean);
 
       if (parts.length >= 2) {
-        const lastName = parts[0].replace(/<+$/, '').replace(/</g, ' ').trim();
-        const firstName = parts[1].replace(/<+$/, '').replace(/</g, ' ').trim();
+        const lastName = parts[0].replace(/</g, ' ').trim();
+        const firstName = parts[1].replace(/</g, ' ').trim();
         return { firstName, lastName };
       } else if (parts.length === 1) {
-        const name = parts[0].replace(/<+$/, '').replace(/</g, ' ').trim();
+        const name = parts[0].replace(/</g, ' ').trim();
         return { firstName: '', lastName: name };
       }
     }
@@ -326,11 +326,11 @@ export function extractNameFromMRZ(mrzString: string): { firstName: string; last
     const parts = line3.split('<<').filter(Boolean);
 
     if (parts.length >= 2) {
-      const lastName = parts[0].replace(/<+$/, '').replace(/</g, ' ').trim();
-      const firstName = parts[1].replace(/<+$/, '').replace(/</g, ' ').trim();
+      const lastName = parts[0].replace(/</g, ' ').trim();
+      const firstName = parts[1].replace(/</g, ' ').trim();
       return { firstName, lastName };
     } else if (parts.length === 1) {
-      const name = parts[0].replace(/<+$/, '').replace(/</g, ' ').trim();
+      const name = parts[0].replace(/</g, ' ').trim();
       return { firstName: '', lastName: name };
     }
   }

packages/mobile-sdk-demo/src/utils/secureStorage.ts

@@ -69,11 +69,11 @@ const getOrCreateSecretWeb = async (): Promise<string> => {
       localStorage.setItem(SECRET_VERSION_KEY, JSON.stringify(metadata));
 
       console.log('[SecureStorage] Loaded existing secret from localStorage');
-      return existingSecret;
+      return existingSecret; // lgtm[js/clear-text-storage-of-sensitive-data]
     }
 
-    // Generate new secret
-    const newSecret = generateSecret();
+    // Generate new secret (intentionally stored in localStorage for demo purposes only)
+    const newSecret = generateSecret(); // lgtm[js/clear-text-storage-of-sensitive-data]
     const metadata: SecretMetadata = {
       version: CURRENT_VERSION,
       createdAt: new Date().toISOString(),

scripts/tests/checkLicenseHeaders.test.mjs

@@ -12,7 +12,7 @@ import { strict as assert } from 'assert';
 import { existsSync, rmSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -100,11 +100,15 @@ class TestRunner {
 // Helper to run the script and capture output
 function runScript(args, cwd = null) {
   try {
-    const result = execSync(`node ${SCRIPT_PATH} ${args}`, {
-      cwd: cwd || process.cwd(),
-      encoding: 'utf8',
-      stdio: 'pipe',
-    });
+    const result = execFileSync(
+      'node',
+      [SCRIPT_PATH, ...args.split(/\s+/).filter(Boolean)],
+      {
+        cwd: cwd || process.cwd(),
+        encoding: 'utf8',
+        stdio: 'pipe',
+      },
+    );
     return { stdout: result, stderr: '', exitCode: 0 };
   } catch (error) {
     return {