Unused Private Field

ID

python.unused_private_field

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Dead Code

Language

Python

Tags

CWE:563, dead-code, reliability

Description

Reports a private instance attribute (single or double leading underscore) that is never read inside the class. Public attributes are out of scope — callers may consume them through the public surface, which the scanner cannot see.

class Klass:
    def __init__(self):
        self._cache = {}      # FLAW — never read
        self._used = 0         # OK — read below
        self.public = 1        # OK — public surface

    def get(self):
        return self._used

Dunder attributes (init, dict, etc.) are excluded — they are protocol attributes, not private state.

Rationale

A private attribute that’s set but never read is dead state — either a leftover from a refactor or a typo where the wrong attribute name is being used elsewhere.

Remediation

  • Delete the assignment.

  • If the field is consumed by a sibling class in a multi-file mixin, rename to a public name or document the pattern.

References