SEC005errorFree tier

inner-html-xss

Direct innerHTML assignment can lead to XSS vulnerabilities

Applies to: JavaScript, TypeScript

Why this matters

Setting innerHTML with user-controlled content is one of the most common XSS vulnerabilities. Attackers can inject malicious scripts that steal cookies, session tokens, or perform actions on behalf of users. Use textContent for plain text, or sanitize HTML with a library like DOMPurify.

Catch it before it ships

pip install stablestack # or: npx stablestackstablestack # scans your project, SEC005 includedstablestack explain SEC005

False positive in your codebase? Suppress a single line with # noqa: SEC005

More Security checks

hardcoded-secret

Hardcoded secrets in code can be leaked and are hard to rotate

sql-injection

SQL queries built with string concatenation are vulnerable to injection

eval-usage

eval() executes arbitrary code and is a security risk

insecure-random

Non-cryptographic random is predictable and insecure for tokens/passwords

webhook-security-bypass

Webhook signature verification should never be skipped

oauth-state-validation

OAuth callback missing state parameter validation

plaintext-secrets

Sensitive tokens stored without encryption in database schema

email-header-injection

User input in email headers may allow header injection