{
"id": "py-hardcoded-secret",
"language": "python",
"group": "security",
"listingTitle": "Py hardcoded secret",
"title": "Review hardcoded secret",
"mvvm": false,
"defaultSeverity": "info",
"legacyGroup": "security",
"why": "Literal credentials committed in source can leak through version history, packages, logs, and deployed artifacts.",
"suggestion": "Load real credentials from a secret provider or runtime configuration; use an obvious placeholder in examples.",
"version": 5,
"semanticMaturity": "text",
"securityKind": "hotspot",
"taxonomy": [
"security"
],
"requirements": [
"sourceText"
],
"packs": [
"python",
"fastapi"
],
"implementation": "src/languages/python/rules.rs",
"languages": [
"python"
],
"frameworks": [],
"languageVersions": [],
"limitations": [
"Only literal statement-level assignments and literal map entries with credential-like names are recognized.",
"Dynamic f-strings, keyword arguments, symbolic values, documentation labels and references, embedded JSON examples, test placeholders, UI relabeling and placeholder metadata, and non-alphanumeric account markers are excluded."
]
}