eval-usage
eval() executes arbitrary code and is a security risk
Applies to: JavaScript, Python, Ruby, TypeScript
Why this matters
eval() takes a string and executes it as code. If any part of that string comes from user input, attackers can run any code they want on your system. There's almost always a safer alternative.
Catch it before it ships
pip install stablestack # or: npx stablestackstablestack # scans your project, SEC003 includedstablestack explain SEC003False positive in your codebase? Suppress a single line with # noqa: SEC003
More Security checks
hardcoded-secret
Hardcoded secrets in code can be leaked and are hard to rotate
SEC002sql-injection
SQL queries built with string concatenation are vulnerable to injection
SEC004insecure-random
Non-cryptographic random is predictable and insecure for tokens/passwords
SEC005inner-html-xss
Direct innerHTML assignment can lead to XSS vulnerabilities
SEC006webhook-security-bypass
Webhook signature verification should never be skipped
SEC007oauth-state-validation
OAuth callback missing state parameter validation
SEC008plaintext-secrets
Sensitive tokens stored without encryption in database schema
SEC009email-header-injection
User input in email headers may allow header injection