How to Scan Configuration Files for Security Issues in Python

import re
import os
from pathlib import Path

SECURITY_RULES = [
    (r'^#\s*INSECURE_', 'Insecure comment starts with # INSECURE_'),
    (r'password\s*=\s*("|\\\')?[^"\\\'"\s]+("|\\\')?$', 'Hardcoded password'),
    (r'debug\s*=\s*True', 'Debug mode enabled'),
    (r'[Pp]ermit[Rr]ootLogin\s+yes', 'PermitRootLogin enabled'),
]

def scan_config_file(filepath: str) -> list[tuple[int, str, str]]:
    issues = []
    try:
        with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
            for line_num, line in enumerate(f, 1):
                for pattern, description in SECURITY_RULES:
                    if re.search(pattern, line.strip()):
                        issues.append((line_num, line.strip()[:60], description))
                        break
    except (FileNotFoundError, PermissionError) as e:
        issues.append((0, str(e), 'File access error'))
    return issues

def scan_directory(directory: str) -> dict[str, list[tuple[int, str, str]]]:
    results = {}
    for path in Path(directory).rglob('*'):
        if path.is_file() and not path.name.startswith('.'):
            issues = scan_config_file(str(path))
            if issues:
                results[str(path)] = issues
    return results

if __name__ == '__main__':
    config_dir = 'sample_configs'
    os.makedirs(config_dir, exist_ok=True)
    with open(f'{config_dir}/app.conf', 'w') as f:
        f.write('# INSECURE_SSL enabled = False\n')
        f.write('password = secret123\n')
        f.write('debug = True\n')
    with open(f'{config_dir}/ssh_config', 'w') as f:
        f.write('PermitRootLogin yes\n')
    findings = scan_directory(config_dir)
    for filepath, issues in sorted(findings.items()):
        print(f"File: {filepath}")
        for line_num, line_snippet, desc in issues:
            print(f"  Line {line_num}: '{line_snippet}' → {desc}")