SEC004errorFree tier

insecure-random

Non-cryptographic random is predictable and insecure for tokens/passwords

Applies to: Go, JavaScript, Python, Ruby, Rust, TypeScript

Why this matters

Python's random module and JavaScript's Math.random() are not cryptographically secure. Attackers can predict the output! For passwords, tokens, or any security purpose, use secrets (Python) or crypto.randomBytes (Node.js).

Catch it before it ships

pip install stablestack # or: npx stablestackstablestack # scans your project, SEC004 includedstablestack explain SEC004

False positive in your codebase? Suppress a single line with # noqa: SEC004

More Security checks

SEC001

hardcoded-secret

Hardcoded secrets in code can be leaked and are hard to rotate

SEC002

sql-injection

SQL queries built with string concatenation are vulnerable to injection

SEC003

eval-usage

eval() executes arbitrary code and is a security risk

SEC005

inner-html-xss

Direct innerHTML assignment can lead to XSS vulnerabilities

SEC006

webhook-security-bypass

Webhook signature verification should never be skipped

SEC007

oauth-state-validation

OAuth callback missing state parameter validation

SEC008

plaintext-secrets

Sensitive tokens stored without encryption in database schema

SEC009

email-header-injection

User input in email headers may allow header injection