Hardcoded admin username assignment in production code should still trigger AUTH711.

username='admin' in test files should not trigger AUTH711.

exec(compile(user_code, ...)) IS dangerous — PY305 (exec) or compile rules must fire.

The cache path and the direct AstEncoder path must be identical.

Hardcoded string attribute name is safe.

String literal assignment → DeveloperDefined → does not reach SQL sink.

Constant + HttpRequest in BinOp → result is HttpRequest (unsafe).

A corrupted JSON cache file must be discarded and rebuilt without error.

@csrf_exempt in test views is acceptable and should not fire.

@csrf_exempt in production code still warrants a warning.

DeveloperDefined literal in f-string → silent.

DeveloperDefined string literal → SQL → silent (no injection risk).

Disk cache must store JSON, not pickle (no arbitrary code execution).

A disk write failure must issue a warning but not abort the scan.

Code resembling Django's cache backend should only flag pickle.loads, not re.compile, json.loads, or other false positives.

encode_node() must produce the same output as json.dumps(..., cls=AstEncoder).

os.environ.get() is now OperatorConfig — opening a path the operator set via environment variable is intentional, not a vulnerability.

FileCacheEntry must be frozen so callers cannot mutate shared state.

Lowercase secret variable must still fire.

INTERNAL_RESET_SESSION_TOKEN = "_password_reset_token" is a module constant. Python: UPPER_CASE = "literal" → DeveloperDefined proven

Test that by default SyntaxWarnings are ignored and files are included.

Test that when enabled, SyntaxWarnings are treated as errors and files are excluded.

Phase 3: getattr(obj, name=attr) with tainted attr must fire.

Global defaults only exclude test files, not production code.

The [defaults] exclude_file_patterns applies to ALL rules without needing to repeat exclude_file_pattern on each rule individually.

Hardcoded file path is safe.

HttpRequest → BinOp % formatting → SQL sink → fires.

FSTRING867 disabled — taint propagates to downstream sinks (PY101, LOG741, etc.).