SEC013warningPro

missing-security-headers

Web applications should set HSTS and CSP security headers

Applies to: JavaScript, MJS, TypeScript

Why this matters

Without Strict-Transport-Security (HSTS), browsers may connect over plain HTTP, enabling man-in-the-middle attacks. Without Content-Security-Policy (CSP), the application is more vulnerable to XSS attacks. These headers are easy to add and provide significant security improvements.

Catch it before it ships

pip install stablestack # or: npx stablestackstablestack # scans your project, SEC013 includedstablestack explain SEC013

SEC013 is part of the Pro rule set. See pricing — the free tier ships 24 checks with no signup.

False positive in your codebase? Suppress a single line with # noqa: SEC013

More Security checks

hardcoded-secret

Hardcoded secrets in code can be leaked and are hard to rotate

sql-injection

SQL queries built with string concatenation are vulnerable to injection

eval-usage

eval() executes arbitrary code and is a security risk

insecure-random

Non-cryptographic random is predictable and insecure for tokens/passwords

inner-html-xss

Direct innerHTML assignment can lead to XSS vulnerabilities

webhook-security-bypass

Webhook signature verification should never be skipped

oauth-state-validation

OAuth callback missing state parameter validation

plaintext-secrets

Sensitive tokens stored without encryption in database schema