# Deliberately vulnerable: hardcoded credentials (CWE-798)
API_KEY = "sk_live_51HxYzABCDEFghijklmnopqrstuvwxyz0123456789"
ADMIN_PASSWORD = "admin123"

def login(user, pw):
    return pw == ADMIN_PASSWORD