Assert used for auth control (ARCH2133)

Key python.security.assert-for-auth-control · Severity warning · Category security · CWE CWE-617

Python assert statements are removed entirely when the interpreter runs with -O. Enforcing authorization or access control with assert means the check never runs in production, enabling authorization bypass.

Incorrect

def delete_account(user, target_id):
    assert user.is_admin, "forbidden"
    db.delete(target_id)

Correct

def delete_account(user, target_id):
    if not user.is_admin:
        raise PermissionError("forbidden")
    db.delete(target_id)

Fix

Enforce security checks with an explicit if and a raised exception, never with assert.