False Negatives in B105/B106/B107 Hardcoded Password Detection

Describe the bug

The current implementations of Bandit's B105 (Hardcoded Password String), B106 (Hardcoded Password Function Arguments), and B107 (Hardcoded Password Default Values) have some false negatives. These rules rely on rigid regular expressions for identifier matching and incomplete AST traversal for comparison operations. Consequently, hardcoded credentials are missed when used with common naming conventions (e.g., camelCase, api_key) or accessed via dictionary subscripts (e.g., data['password']).

For example

import pymysql
from genai import configure

class ConfigLoader:
    def __init__(self, data):
        self.data = data

    def authenticate_user(self):
        # FAILS
        # The rule expects ast.Name (e.g., 'password') or ast.Attribute (e.g., 'obj.password').
        # It misses dictionary access like data['password'].
        if self.data['password'] == 'hardcoded_secret_123':
            return True
        return False

    def load_credentials(self):
        # FAILS
        # 'DATABASEPASSWORD' does not match ^password$ or _password_.
        DATABASEPASSWORD = "password123"
        
        # FAILS: 'api_key' is not in the RE_WORDS list (password, secret, token, etc.).
        # Common credential identifiers like 'api_key', 'API_KEY)' are ignored.
        configure(api_key="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")

Reproduction steps

bandit -r  the_code_above.py

Expected behavior

3 alarms on these hardcoded cases

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

No response

Start with the B105, B106, and B107 implementations and inspect how identifier matching and comparison-operation AST traversal handle names, attributes, and subscripts. Run the provided bandit reproduction against the example code, then verify that the three hardcoded credential cases produce alarms without regressing existing detections.