title: hardcoded password / credentials
body: <p>I am in the middle of reviewing security for Python code. </p>
  
  <p>For that, I am using tools like Bandits (a module for Python) and DeepCode (www.deepcode.ai). Bandit found that there are some vulnerabilities in hardcoding login and password, whereas no vulnerabilities was found with DeepCode. here is the code in question :</p>
  
  <pre><code># Guest only login
  # Used for Login as Guest button and login the current session as GUEST
  APP_GUEST_USERNAME = "ppams.asguest"
  APP_GUEST_PASSWORD = "ppams123456"
  
  # SECURITY WARNING: keep the secret key used in production secret!
  SECRET_KEY = '10-6d$q$&amp;xxc9heb(hjeda$w%7pxC#+hhx%b0xl&amp;_q(p8(u#uu'
  </code></pre>
  
  <p>I found articles that credentials should not be hardcoded. Here are some articles : <a href="https://qxf2.com/blog/dont-hardcode-usernames-and-passwords-in-your-test-scripts/" rel="nofollow noreferrer">https://qxf2.com/blog/dont-hardcode-usernames-and-passwords-in-your-test-scripts/</a> ; <a href="https://www.owasp.org/index.php/Use_of_hard-coded_password" rel="nofollow noreferrer">https://www.owasp.org/index.php/Use_of_hard-coded_password</a> ; <a href="https://www.preemptive.com/blog/article/1059-create-more-secure-applications-don-t-hard-code-credentials-instead-use-application-hardening/106-risk-management" rel="nofollow noreferrer">https://www.preemptive.com/blog/article/1059-create-more-secure-applications-don-t-hard-code-credentials-instead-use-application-hardening/106-risk-management</a>.</p>
  
  <p>So, whats the risk of using hard coded credentials ? Can you show me some samples ?
  What is the alternative way to secure credentials if credentials cant be hard coded ?</p>
  
  <p>Thanks</p>