Rule Definition
Comparing passwords to hard-coded strings is equivalent to having a hard-coded password in source code. Hardcoded passwords in source code should be avoided because they can potentially be retrieved through code inspection and inverse engineering by attackers. Such an attack is difficult to be discovered, and eventually the problem can only be solved at software level thus compromising the usability of the application in the meantime.

Remediation
A non-secure starting patch would be to apply obfuscation techniques to the hardcoded password to prevent reverse-engineering of the generated Python (byte)code. This could be done by hashing the password or constructing the password string in many different places by non-trivial methods. Sensitive data such as passwords should be in principle encrypted and saved in separate files or in a database with restricted user access. Finally one should consider removing backdoors and delegate the password ownership to the end-user.

Violation Code Sample

password == "WinterIsComing"
...
String.Equals(password,"WinterIsComing")
...
String.Compare(password,"WinterIsComing")
...
password.CompareTo("WinterIsComing")
...
const string passwd = "WinterIsComing";
if (password == passwd)
...

Fixed Code Sample

password == getpwdsafe()
...
String.Equals(password,getpwdsafe())
...
String.compare(password,getpwdsafe())
...
password.CompareTo(getpwdsafe())
...
const string passwd = getpwdsafe();
if (password == passwd)
...

https://cwe.mitre.org/data/definitions/259.html