Language: Python
Label: vulnerable
CWE: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Code:
def secret_path(monkeypatch, tmp_path):
    secret_path = str(tmp_path / '.test')
    monkeypatch.setattr(auth, 'SECRET_FILE_PATH', secret_path)
    yield secret_path