SEC006errorFree tier

webhook-security-bypass

Webhook signature verification should never be skipped

Applies to: JavaScript, Python, TypeScript

Why this matters

Webhook endpoints receive data from external services (Stripe, GitHub, etc.). Without signature verification, attackers can forge webhook payloads to trigger unauthorized actions like fake payments or deployments. Patterns that skip verification 'for development' often accidentally ship to production.

Catch it before it ships

pip install stablestack # or: npx stablestackstablestack # scans your project, SEC006 includedstablestack explain SEC006

False positive in your codebase? Suppress a single line with # noqa: SEC006

More Security checks

hardcoded-secret

Hardcoded secrets in code can be leaked and are hard to rotate

sql-injection

SQL queries built with string concatenation are vulnerable to injection

eval-usage

eval() executes arbitrary code and is a security risk

insecure-random

Non-cryptographic random is predictable and insecure for tokens/passwords

inner-html-xss

Direct innerHTML assignment can lead to XSS vulnerabilities

oauth-state-validation

OAuth callback missing state parameter validation

plaintext-secrets

Sensitive tokens stored without encryption in database schema

email-header-injection

User input in email headers may allow header injection