id: PY-SEC-003
name: hardcoded-secrets
severity: high
language: python
cwe: CWE-798
owasp: "A07:2021"
description: "Detect hardcoded passwords, API keys, tokens, and other secrets in variable assignments."
pattern:
  type: regex
  regex:
    - "(?i)(password|passwd|secret|api_key|apikey|token|auth)\\s*=\\s*[\"'][^\"']+[\"']"
    - "(?i)(aws_access_key|aws_secret)\\s*=\\s*[\"']"
message: "Possible hardcoded secret detected. Sensitive credentials should never be stored directly in source code."
fix_hint: "Use environment variables, a secrets manager, or a .env file excluded from version control."
references:
  - "https://cwe.mitre.org/data/definitions/798.html"
  - "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
