# Dangerous Code Patterns by Language
| Language | Pattern | Risk |
|----------|---------|------|
| Python | `eval()`, `exec()`, `pickle.loads()` | Code execution |
| Python | `subprocess.call(shell=True)` | Command injection |
| JavaScript | `innerHTML`, `eval()`, `document.write()` | XSS |
| JavaScript | `child_process.exec()` | Command injection |
| Go | `os/exec` with user input | Command injection |
| SQL | String concatenation in queries | SQL injection |
| Java | `Runtime.getRuntime().exec()` | Command injection |
| Any | Hardcoded passwords, API keys, tokens | Credential exposure |
| Any | `chmod 777`, `0.0.0.0` binds | Overpermissive defaults |
