I'm also curious, how would it handle using a default for next, such as next(iter([]), 'foo')?

@RasmusWL I suppose it would still flag an error, but this might be undesired. Should we add a new test case to remove false positives?

@RasmusWL I suppose it would still flag an error, but this might be undesired. Should we add a new test case to remove false positives?

Yes. I think we should at least have a test-case for this. (don't know whether we care to handle it with our current security focus). I think handling this should be quite easy, don't alert if the default parameter is present