Fix: use approved placeholder

Replace hardcoded passwords and secrets in tests with env/cred-helper
values or per-run generated values, and drop the deepcode ignore
suppression comments. Clears the Snyk Code NoHardcodedPasswords and
HardcodedNonCryptoSecret findings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: reeshika-h

tests/api/users/test_api.py

@@ -44,10 +44,8 @@ def test_active_user(self):
             "user": {
                 "first_name": "your_first_name",
                 "last_name": "your_last_name",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password": "your_password",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password_confirmation": "confirm_your_password"
+                "password": password,
+                "password_confirmation": password
             }
         }
         response = self.client.user().activate(activation_token, act_data)
@@ -80,10 +78,8 @@ def test_reset_password(self):
         act_data = {
             "user": {
                 "reset_password_token": "abcdefghijklmnop1234567890",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password": "Simple@123",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password_confirmation": "Simple@123"
+                "password": password,
+                "password_confirmation": password
             }
         }
         response = self.client.user().reset_password(act_data)

tests/integration/api/test_01_user.py

@@ -1,11 +1,16 @@
 """User API tests — profile fetch and update."""
 
+import os
+
 import pytest
 
 from framework import helpers as h
 
 pytestmark = pytest.mark.order(1)
 
+# Exercised only with bogus tokens; value comes from the environment, no fallback.
+TEST_PASSWORD = os.environ.get("TEST_USER_PASSWORD")
+
 
 class TestUser:
     def test_fetch(self, ctx):
@@ -26,14 +31,12 @@ class TestUserAuthOps:
     """Account auth endpoints exercised safely (bogus tokens / non-real email)."""
 
     def test_activate_bogus_token(self, ctx):
-        # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-        resp = ctx.client.user().activate("bogus_activation_token", {"user": {"password": "Test@12345"}})
+        resp = ctx.client.user().activate("bogus_activation_token", {"user": {"password": TEST_PASSWORD}})
         h.assert_status(resp, 400, 404, 422)
 
     def test_reset_password_bogus_token(self, ctx):
         resp = ctx.client.user().reset_password(
-            # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret            
-            {"user": {"reset_password_token": "bogus", "password": "Test@12345", "password_confirmation": "Test@12345"}}
+            {"user": {"reset_password_token": "bogus", "password": TEST_PASSWORD, "password_confirmation": TEST_PASSWORD}}
         )
         h.assert_status(resp, 400, 404, 422)
 

tests/mock/users/test_mock.py

@@ -38,10 +38,8 @@ def test_mock_active_user(self):
             "user": {
                 "first_name": "your_first_name",
                 "last_name": "your_last_name",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password": "your_password",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password_confirmation": "confirm_your_password"
+                "password": password,
+                "password_confirmation": password
             }
         }
 
@@ -81,10 +79,8 @@ def test_reset_password(self):
         act_data = {
             "user": {
                 "reset_password_token": "abcdefghijklmnop1234567890",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password": "Simple@123",
-                # deepcode ignore NoHardcodedPasswords: test fixture value, not a real secret
-                "password_confirmation": "Simple@123"
+                "password": password,
+                "password_confirmation": password
             }
         }
         response = self.client.user().reset_password(act_data).json()

tests/unit/contentstack/test_totp_login.py

@@ -1,3 +1,4 @@
+import base64
 import unittest
 import os
 import sys
@@ -18,8 +19,7 @@ def setUp(self):
         self.client = Client()
         self.test_email = "test@example.com"
         self.test_password = "test_password"
-        # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
-        self.test_secret = "JBSWY3DPEHPK3PXP"  # Standard test secret for TOTP
+        self.test_secret = base64.b32encode(os.urandom(10)).decode()  # Valid base32 TOTP secret generated per test run
         self.test_tfa_token = "123456"
 
     def tearDown(self):
@@ -38,9 +38,7 @@ def test_login_method_signature_with_totp(self):
         # Test that the method accepts TOTP parameters without error
         try:
             client.login(self.test_email, self.test_password, tfa_token=self.test_tfa_token)
-            # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             client.login(self.test_email, self.test_password, mfa_secret=self.test_secret)
-            # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             client.login(self.test_email, self.test_password, tfa_token=self.test_tfa_token, mfa_secret=self.test_secret)
         except Exception as e:
             self.fail(f"Login method should accept TOTP parameters without error: {e}")
@@ -74,7 +72,6 @@ def test_login_with_mfa_secret_generates_totp(self):
                     result = self.client.login(
                         self.test_email, 
                         self.test_password, 
-                        # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
                         mfa_secret=self.test_secret
                     )
 

tests/unit/test_oauth_handler.py

@@ -5,6 +5,7 @@
 import json
 import time
 import unittest
+import uuid
 from unittest.mock import Mock, patch, MagicMock
 import requests
 
@@ -19,7 +20,7 @@ def setUp(self):
         self.app_id = "test-app-id"
         self.client_id = "test-client-id"
         self.redirect_uri = "http://localhost:3000/callback"
-        self.client_secret = "test-client-secret"
+        self.client_secret = uuid.uuid4().hex  # Generated per test run, not a real secret
         self.scope = ["read", "write"]
         self.api_client = Mock()
         self.api_client.headers = {}
@@ -31,7 +32,6 @@ def setUp(self):
             app_id=self.app_id,
             client_id=self.client_id,
             redirect_uri=self.redirect_uri,
-            # deepcode ignore HardcodedNonCryptoSecret: test fixture value, not a real secret
             client_secret=self.client_secret,
             scope=self.scope,
             api_client=self.api_client