chore: add checker to detect flask secrets used as salt for HashIDs

[MashyBasker]

Test logs:

echo "Testing built-in rules..."
Testing built-in rules...
./bin/globstar test -d checkers/
Running test case: avoid_add.yml
Running test case: avoid_latest.yml
Running test case: avoid_sudo.yml
Running test case: dangerous_eval.yml
Running test case: avoid-marksafe.yml
Running test case: context-autoescape-off.yml
Running test case: filter-issafe.yml
Running test case: format-html-param.yml
Running test case: hashids-with-flask-secret.yml
Running test case: safe-string-extend.yml
All tests passed        globstar.dev/cmd/globstar               coverage: 0.0% of statements
        globstar.dev/pkg/config         coverage: 0.0% of statements
        globstar.dev/pkg/cli            coverage: 0.0% of statements
ok      globstar.dev/pkg/analysis       0.005s  coverage: 22.7% of statements
Total coverage: 13.9%

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
globstar	⬜️ Ignored (Inspect)	Visit Preview		Feb 27, 2025 6:02pm

[sanket-deepsource]

Python's hashids package has been renamed to sqids. We should handle this for both imports.

On another note, maybe we should make this checker generic and handle other libraries as well that people use for creating hashed identifiers?

[MashyBasker]

Python's hashids package has been renamed to sqids. We should handle this for both imports.

I’ll push a commit to address this.

On another note, maybe we should make this checker generic and handle other libraries as well that people use for creating hashed identifiers?

That makes sense. I previously added a similar checker for Django. I will review other libraries that might be affected and work on making the checker more generic to cover them as well.