init: deliberately vulnerable demo (CWE-798/327/89/78/319)

2026-07-21 10:39:18 +02:00
commit 8cdac0dcb6
5 changed files with 31 additions and 0 deletions
@@ -0,0 +1,6 @@
+# Deliberately vulnerable: hardcoded credentials (CWE-798)
+API_KEY = "sk_live_51HxYzABCDEFghijklmnopqrstuvwxyz0123456789"
+ADMIN_PASSWORD = "admin123"
+
+def login(user, pw):
+    return pw == ADMIN_PASSWORD