rules:
- id: hardcoded-password-default-argument
  message: >-
    Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous
    if
    a real password is not supplied.
  languages: [python]
  severity: WARNING
  patterns:
    - pattern: |
        def $FUNC(..., password="...", ...):
          ...
    - pattern-not: |
        def $FUNC(..., password="", ...):
          ...
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    category: security
    technology:
    - python
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW