Skip to content

mock-email-address

Category: Mock Data
Severity: Warning
Triggered by: pyscn check --select mockdata

What it does

Flags email addresses whose domain part is reserved for testing: test@example.com, admin@test.com, foo@localhost, and similar.

Why is this a problem?

A test-domain email in application code is almost always a leftover from a fixture, a tutorial, or a "fill this in later" stub. Unlike a malformed address, it passes validation and serialisation cleanly, so it silently ends up in database rows, notification queues, and "from" headers. The usual discovery path is a support ticket asking why no one received a reset link.

This rule complements mock-domain-in-string but treats the email form specifically so it can keep the domain list tight and the match precise.

Example

admin_email = "admin@example.com"

Use instead

Read the address from configuration, or accept it as a parameter.

admin_email = settings.admin_email

Options

Option Default Description
mock_data.enabled false Opt-in.
mock_data.domains (RFC 2606 list) Domains considered placeholder; shared with mock-domain-in-string.
mock_data.min_severity "info" Raise to "warning" for only this-level findings.
mock_data.ignore_tests true Skip test files.
mock_data.ignore_patterns [] Regex patterns matched against file paths.

References