python-authentication-failures

A set of checks for finding common identification and login security problems in Python applications, based on the OWASP Top 10 security risks. It looks for issues such as weak passwords, hardcoded credentials, and unsafe password storage.

In plain words
What is it for?
Scanning Python code for weak password validation, embedded credentials, plain-text password handling, and outdated hashing algorithms.
Why use it?
It highlights patterns that can allow unauthorized access or expose user credentials. The checks encourage stronger password rules, protected secrets, and secure password hashing.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/abderrahimghazali/cursor-rules/python-authentication-failures
Clone the repo
git clone --depth 1 https://github.com/abderrahimghazali/cursor-rules

Made for: Cursor.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 2,957 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.02957
Opus 5 $0.00000 $0.01478
Sonnet 5 $0.00000 $0.00591
Haiku 4.5 $0.00000 $0.00296

Measured yesterday against content hash 09cc1731fa24, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

python-authentication-failures scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/python-authentication-failures.mdc · 338 lines

How it starts

The opening of the file, as written. The whole thing — 338 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Python Identification and Authentication Failures Standards (OWASP A07:2021)

This rule enforces security best practices to prevent identification and authentication failures in Python applications, as defined in OWASP Top 10:2021-A07.

actions:

  • type: enforce conditions:

    Pattern 1: Weak password validation

    • pattern: "password\s*=\s*['"][^'"]{1,7}['"]|min_length\s*=\s*[1-7]" message: "Weak password policy detected. Passwords should be at least 8 characters long and include complexity requirements."

    Pattern 2: Hardcoded credentials

    • pattern: "(username|user|login|password|passwd|pwd|secret|api_key|apikey|token)\s*=\s*['"][^'"]+['"]" message: "Hardcoded credentials detected. Store sensitive credentials in environment variables or a secure vault."

    Pattern 3: Missing password hashing

    • pattern: "password\s*=\srequest\.form\[\'password\'\]|password\s=\s*request\.POST\.get\(\'password\'\)" message: "Storing or comparing plain text passwords detected. Always hash passwords before storage or comparison."

    Pattern 4: Insecure password hashing

    • pattern: "hashlib\.md5\(|hashlib\.sha1\(|hashlib\.sha224\(" message: "Insecure hashing algorithm detected. Use strong hashing algorithms like bcrypt, Argon2, or PBKDF2."

    Pattern 5: Missing brute force protection

    • pattern: "@app\.route\(['"]\/(login|signin|authenticate)['"]" message: "Authentication endpoint detected without rate limiting or brute force protection. Implement account lockout or rate limiting."

    Pattern 6: Insecure session management

    • pattern: "session\[\'user_id\'\]\s*=|session\[\'authenticated\'\]\s*=\s*True" message: "Session management detected. Ensure proper session security with secure cookies, proper expiration, and rotation."

    Pattern 7: Missing CSRF protection in authentication

    • pattern: "form\s*=\sFlaskForm|class\s+\w+Form\(\sFlaskForm\s*\)|class\s+\w+Form\(\sForm\s\)" message: "Form handling detected. Ensure CSRF protection is enabled for all authentication forms."

    Pattern 8: Insecure remember me functionality

    • pattern: "remember_me|remember_token|stay_logged_in" message: "Remember me functionality detected. Ensure secure implementation with proper expiration and refresh mechanisms."

    Pattern 9: Insecure password reset

    • pattern: "@app\.route\(['"]\/(reset-password|forgot-password|recover)['"]" message: "Password reset functionality detected. Ensure secure implementation with time-limited tokens and proper user verification."

    Pattern 10: Missing multi-factor authentication

    • pattern: "def\s+login|def\s+authenticate|def\s+signin" message: "Authentication function detected. Consider implementing multi-factor authentication for sensitive operations."

    Pattern 11: Insecure direct object reference in user management

    • pattern: "User\.objects\.get\(id=|User\.query\.get\(|get_user_by_id\(" message: "Direct user lookup detected. Ensure proper authorization checks before accessing user data."

    Pattern 12: Insecure JWT implementation

    • pattern: "jwt\.encode\(|jwt\.decode\(" message: "JWT usage detected. Ensure proper signing, validation, expiration, and refresh mechanisms for JWTs."

    Pattern 13: Missing secure flag in cookies

    • pattern: "set_cookie\([^,]+,[^,]+,[^,]secure=False|set_cookie\([^,]+,[^,]+(?!,\ssecure=True)" message: "Cookie setting without secure flag detected. Set secure=True for all authentication cookies."

Read the full file on GitHub · 338 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 338 lines · 2,957 tokens per session scan A 09cc1731fa24

Subscribe to this mod's changes

python-authentication-failures is a cursor rule published in the GitHub repository abderrahimghazali/cursor-rules (2 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,957 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.