Describe the bug
The current implementations of Bandit's B105 (Hardcoded Password String), B106 (Hardcoded Password Function Arguments), and B107 (Hardcoded Password Default Values) have some false negatives. These rules rely on rigid regular expressions for identifier matching and incomplete AST traversal for comparison operations. Consequently, hardcoded credentials are missed when used with common naming conventions (e.g., camelCase, api_key) or accessed via dictionary subscripts (e.g., data['password']).
For example
import pymysql
from genai import configure
class ConfigLoader:
def __init__(self, data):
self.data = data
def authenticate_user(self):
# FAILS
# The rule expects ast.Name (e.g., 'password') or ast.Attribute (e.g., 'obj.password').
# It misses dictionary access like data['password'].
if self.data['password'] == 'hardcoded_secret_123':
return True
return False
def load_credentials(self):
# FAILS
# 'DATABASEPASSWORD' does not match ^password$ or _password_.
DATABASEPASSWORD = "password123"
# FAILS: 'api_key' is not in the RE_WORDS list (password, secret, token, etc.).
# Common credential identifiers like 'api_key', 'API_KEY)' are ignored.
configure(api_key="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
Reproduction steps
bandit -r the_code_above.py
Expected behavior
3 alarms on these hardcoded cases
Bandit version
1.9.1 (Default)
Python version
3.14 (Default)
Additional context
No response
Describe the bug
The current implementations of Bandit's B105 (Hardcoded Password String), B106 (Hardcoded Password Function Arguments), and B107 (Hardcoded Password Default Values) have some false negatives. These rules rely on rigid regular expressions for identifier matching and incomplete AST traversal for comparison operations. Consequently, hardcoded credentials are missed when used with common naming conventions (e.g., camelCase, api_key) or accessed via dictionary subscripts (e.g., data['password']).
For example
Reproduction steps
Expected behavior
3 alarms on these hardcoded cases
Bandit version
1.9.1 (Default)
Python version
3.14 (Default)
Additional context
No response