id: PY-SEC-024
name: weak-password-hash
severity: high
language: python
cwe: CWE-916
owasp: "A02:2021"
description: "Detect use of non-password-specific hashing for password storage."
pattern:
  type: regex
  regex:
    - '(?i)hashlib\.\w+\(.*password'
    - '(?i)sha256\(.*password'
    - '(?i)md5\(.*password'
message: "Weak password hashing detected. Generic hash functions are too fast for password storage and are vulnerable to brute-force attacks."
fix_hint: "Use bcrypt, argon2-cffi, or passlib with scrypt/bcrypt for password hashing."
references:
  - https://cwe.mitre.org/data/definitions/916.html
  - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
  - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
