Attempt to improve hardcoded password checks for strings by alanverresen · Pull Request #1340 · PyCQA/bandit

alanverresen · 2025-12-01T23:47:24Z

This pull request attempts to improve the hardcoded password checks for strings:

overhauls the hardcoded_password_string() function
- adds checks for annotated assignments
- refactors checks for regular assignments and dictionaries
- simplifies checks for comparisons and covers more cases
overhauls test examples used to test plugin
- reorganizes file to improve its structure
- adds more examples to thoroughly test checks
- adds tests based on examples of past GitHub issues for regression testing

This pull request also closes several issues:

for more information, see https://pre-commit.ci

alanverresen added 11 commits December 1, 2025 11:28

Add check for hardcoded passwords in annotated assignments.

df7c27c

Refactored password checks for assignments and dictionaries.

b9fb2e7

Cleaned up checks a bit.

0454abe

Reordered hardcoded password tests.

e061300

Clean up hardcoded password tests for assignments.

132a4fe

Clean up hardcoded password tests for annotated assignments.

2f2d3bb

Clean up hardcoded password tests for dictionaries.

282cca7

Clean up hardcoded password tests for comparisons.

09bae71

Add hardcoded password tests for comparisons with more than 2 operands.

241901f

Fixed comparison checks for hardcoded passwords.

742bcf2

Add examples from issues of hardcoded password checks.

f973020

alanverresen requested review from ericwb, lukehinds and sigmavirus24 as code owners December 1, 2025 23:47

[pre-commit.ci] auto fixes from pre-commit.com hooks

c39fe4e

for more information, see https://pre-commit.ci

Provide feedback