csv-formula-injection
CSV export without formula injection protection
Applies to: JavaScript, Python, TypeScript
Why this matters
CSV cells starting with =, +, -, or @ are interpreted as formulas by spreadsheet applications. Attackers can inject formulas that exfiltrate data or execute code when the CSV is opened.
Catch it before it ships
pip install stablestack # or: npx stablestackstablestack # scans your project, SEC010 includedstablestack explain SEC010SEC010 is part of the Pro rule set. See pricing — the free tier ships 24 checks with no signup.
False positive in your codebase? Suppress a single line with # noqa: SEC010
More Security checks
hardcoded-secret
Hardcoded secrets in code can be leaked and are hard to rotate
SEC002sql-injection
SQL queries built with string concatenation are vulnerable to injection
SEC003eval-usage
eval() executes arbitrary code and is a security risk
SEC004insecure-random
Non-cryptographic random is predictable and insecure for tokens/passwords
SEC005inner-html-xss
Direct innerHTML assignment can lead to XSS vulnerabilities
SEC006webhook-security-bypass
Webhook signature verification should never be skipped
SEC007oauth-state-validation
OAuth callback missing state parameter validation
SEC008plaintext-secrets
Sensitive tokens stored without encryption in database schema