email-header-injection
User input in email headers may allow header injection
Applies to: JavaScript, Python, TypeScript
Why this matters
Email headers are delimited by newlines (CRLF). If user input containing newlines is included in headers, attackers can inject arbitrary headers like BCC to exfiltrate emails or From to spoof senders.
Catch it before it ships
pip install stablestack # or: npx stablestackstablestack # scans your project, SEC009 includedstablestack explain SEC009SEC009 is part of the Pro rule set. See pricing — the free tier ships 24 checks with no signup.
False positive in your codebase? Suppress a single line with # noqa: SEC009
More Security checks
hardcoded-secret
Hardcoded secrets in code can be leaked and are hard to rotate
SEC002sql-injection
SQL queries built with string concatenation are vulnerable to injection
SEC003eval-usage
eval() executes arbitrary code and is a security risk
SEC004insecure-random
Non-cryptographic random is predictable and insecure for tokens/passwords
SEC005inner-html-xss
Direct innerHTML assignment can lead to XSS vulnerabilities
SEC006webhook-security-bypass
Webhook signature verification should never be skipped
SEC007oauth-state-validation
OAuth callback missing state parameter validation
SEC008plaintext-secrets
Sensitive tokens stored without encryption in database schema