- Analyzer
- semgrep
- Category
- Secrets
- Default severity
- HIGH
- CWE
- CWE-327
- Execution
- Passive
- Authentication
- Not required
- Applicability
- python
- Availability
- stable
What it detects
hashlib.sha1() on a password variable: a secrets check run by the semgrep analyzer.
Evidence
The Semgrep source location, rule identity, and bounded match context normalized into Fendix evidence.
Remediation
hashlib.sha1() used on a password-shaped variable. SHA1 is unsuitable for password hashing (fast hash, no work factor). Use bcrypt, scrypt, argon2, or PBKDF2 instead.
Limitations
This check is limited to the applicability and evidence delivered by semgrep. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Checks sharing a CWE
Remediation guidance: Remediation and fix verification · Baselines and suppressions