oauth-state-validation
OAuth callback missing state parameter validation
Applies to: JavaScript, Python, TypeScript
Why this matters
The OAuth state parameter prevents CSRF attacks during the OAuth flow. Without validating that the state matches what was sent in the initial authorization request, attackers can trick users into linking attacker-controlled accounts or stealing tokens.
Catch it before it ships
pip install stablestack # or: npx stablestackstablestack # scans your project, SEC007 includedstablestack explain SEC007SEC007 is part of the Pro rule set. See pricing — the free tier ships 24 checks with no signup.
False positive in your codebase? Suppress a single line with # noqa: SEC007
More Security checks
hardcoded-secret
Hardcoded secrets in code can be leaked and are hard to rotate
SEC002sql-injection
SQL queries built with string concatenation are vulnerable to injection
SEC003eval-usage
eval() executes arbitrary code and is a security risk
SEC004insecure-random
Non-cryptographic random is predictable and insecure for tokens/passwords
SEC005inner-html-xss
Direct innerHTML assignment can lead to XSS vulnerabilities
SEC006webhook-security-bypass
Webhook signature verification should never be skipped
SEC008plaintext-secrets
Sensitive tokens stored without encryption in database schema
SEC009email-header-injection
User input in email headers may allow header injection