__secret (two leading underscores) are rewritten to _ClassName__secret. Build Vault storing __pin from the constructor with a method check(pin) comparing against it. Then write the module-level function crack(vault) that reads the pin anyway via the mangled name — proving mangling is collision-avoidance, not security.Vault('1234').check('1234')True
Inside the class the name works unmangled.
crack(Vault('1234'))'1234'
The mangled attribute is reachable from outside.
The mangled name is _Vault__pin.
getattr(vault, "_Vault__pin") or direct attribute access.