Python hardcoded password or API key compared to literal
Rule ID: vetkit.py.auth.hardcoded-credential-compare
A password, API key or token is compared against a string literal. The credential lives in source control and cannot be rotated without a deployment; anyone who reads the code can authenticate.
Last updated:
Suite: Security
python
A password, API key or token is compared against a string literal. The credential lives in source control and cannot be rotated without a deployment; anyone who reads the code can authenticate.
Category: SECURITY · Engine rule severity: ERROR
How to fix it
Load the expected credential from the environment or a secret manager and compare it with secrets.compare_digest(); for users, store salted password hashes instead of plaintext values.
References
Source: packages/engine/rules/sast/python.yml.
Related checks
- Python assert used for authorization is removed by -O
- Python cleartext FTP or Telnet connection (ftplib, telnetlib)
- Python cloud SDK client with hardcoded secret access key
- Python eval() and exec() with non-literal argument
- Python dynamic import of module name from request input
- Python getattr() with attribute name from request input
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.