SEC002errorFree tier

sql-injection

SQL queries built with string concatenation are vulnerable to injection

Applies to: Go, JavaScript, Python, Ruby, Rust, TypeScript

Why this matters

Building SQL queries by concatenating strings allows attackers to inject malicious SQL code. If a user enters "'; DROP TABLE users; --" as their name, your database could be destroyed. Always use parameterized queries.

Catch it before it ships

pip install stablestack # or: npx stablestackstablestack # scans your project, SEC002 includedstablestack explain SEC002

False positive in your codebase? Suppress a single line with # noqa: SEC002

More Security checks

SEC001

hardcoded-secret

Hardcoded secrets in code can be leaked and are hard to rotate

SEC003

eval-usage

eval() executes arbitrary code and is a security risk

SEC004

insecure-random

Non-cryptographic random is predictable and insecure for tokens/passwords

SEC005

inner-html-xss

Direct innerHTML assignment can lead to XSS vulnerabilities

SEC006

webhook-security-bypass

Webhook signature verification should never be skipped

SEC007

oauth-state-validation

OAuth callback missing state parameter validation

SEC008

plaintext-secrets

Sensitive tokens stored without encryption in database schema

SEC009

email-header-injection

User input in email headers may allow header injection