# Adapted from bandit rule 'B105 hardcoded_password_string'
# See ../LICENSE and ../NOTICE for license terms.

id: B105-hardcoded-password
name: Hardcoded password string
message: Possible hardcoded password assignment
severity: high
category: security
languages: [python]
confidence: 0.7
cwe: CWE-798
pattern: '(?i)\b(password|passwd|pwd|secret|token|api_key|apikey)\s*=\s*[''"][^''"]{3,}[''"]'
explanation: |
  Storing credentials in source code makes them easy to leak via version
  control, logs, or stack traces. Bandit B105 catches the string-assignment
  variant.
recommendation: |
  Move credentials to a secret manager (env vars, AWS Secrets Manager,
  Vault) and read them at runtime. For tests, use clearly-non-credential
  placeholders (e.g. ``"PLACEHOLDER"``).
references:
  - https://bandit.readthedocs.io/en/latest/plugins/b105_hardcoded_password_string.html
  - https://cwe.mitre.org/data/definitions/798.html
