SEC001errorFree tier

hardcoded-secret

Hardcoded secrets in code can be leaked and are hard to rotate

Applies to: C#, Go, JSON, JavaScript, Python, Ruby, Rust, TypeScript, YAML, dotenv

Why this matters

Hardcoding passwords or API keys in your code is dangerous. Anyone who sees your code (including in git history) can see your secrets. Use environment variables or a secrets manager instead.

Catch it before it ships

pip install stablestack # or: npx stablestackstablestack # scans your project, SEC001 includedstablestack explain SEC001

False positive in your codebase? Suppress a single line with # noqa: SEC001

More Security checks

SEC002

sql-injection

SQL queries built with string concatenation are vulnerable to injection

SEC003

eval-usage

eval() executes arbitrary code and is a security risk

SEC004

insecure-random

Non-cryptographic random is predictable and insecure for tokens/passwords

SEC005

inner-html-xss

Direct innerHTML assignment can lead to XSS vulnerabilities

SEC006

webhook-security-bypass

Webhook signature verification should never be skipped

SEC007

oauth-state-validation

OAuth callback missing state parameter validation

SEC008

plaintext-secrets

Sensitive tokens stored without encryption in database schema

SEC009

email-header-injection

User input in email headers may allow header injection