auth/hardcoded-role regex misses quoted role comparisons (most common pattern)

[ajianaz]

Problem

The auth/hardcoded-role security pattern only matches unquoted role comparisons, missing the most common real-world pattern with quoted strings:

Current Regex

regex: r"(?i)role\s*==\s*(?:admin|super|root)|is_admin\s*==\s*True",

What It Misses

Pattern	Detected?	Note
role == admin	✅	Bareword (rare outside Ruby/PHP)
role == "admin"	❌	Most common — JS, TS, Python, Go
user.role == "admin"	❌	Property access + quotes
role === "admin"	❌	Strict equality (JS/TS)
role == "super"	❌
if role == "root": ...	❌	Python

Fix

Add optional quotes and property access:

regex: r#"(?i)(?:\.?\w+\.)*role\s*[=]{2,3}\s*["']?(?:admin|super|root)["']?|is_admin\s*==\s*True"#,

Related

• Epic: Add post-match filters to remaining security scanner rules (defense-in-depth) #487 — Epic: post-match filters for security rules
• Static security scanner false positive: injection/sql-concat matches comments and non-SQL concatenation #485 — injection/sql-concat false positive (same class of issue)