Bandit

Bandit is a security linter for Python maintained by PyCQA. It processes each file, builds an abstract syntax tree (AST), and runs a suite of security plugins against the AST nodes to flag common vulnerabilities — hardcoded passwords, use of insecure functions, injection risks, weak cryptography, and more — then produces a consolidated report.

Originally developed within the OpenStack Security Project and later rehomed to PyCQA, Bandit is a staple of Python CI pipelines and pre-commit setups. It ships as a command-line tool with configurable severity/confidence thresholds, plugin selection, baselines, and multiple report formats.

What You Get

• A CLI that recursively scans Python files and directories for security issues
• A library of built-in plugins covering injection, weak crypto, hardcoded secrets, insecure deserialization, and more
• Configurable severity and confidence thresholds to tune signal versus noise
• Baseline support to suppress known findings and surface only new ones
• Multiple output formats (screen, JSON, CSV, XML, HTML, SARIF) for humans and tooling

Common Use Cases

• Gating pull requests in CI on newly introduced security issues
• Running as a pre-commit hook to catch insecure patterns before they land
• Auditing an existing Python codebase for common vulnerabilities
• Producing SARIF/JSON reports for security dashboards and code-scanning platforms

Under The Hood

Architecture - Bandit’s core builds a Python AST for each target file and dispatches nodes to registered plugins via a node-visitor pattern; plugins are discovered through entry points and grouped by the AST node types they care about. A manager coordinates file discovery, plugin execution, and result aggregation, while a metrics/report layer formats findings by severity and confidence. Tech Stack - Written almost entirely in Python (99.9% of the codebase), it uses the standard-library ast module, PyYAML for configuration, stevedore for plugin loading, and rich for terminal output; it is packaged with setuptools and distributed on PyPI. Code Quality - The project is mature and actively maintained (1,500+ commits, frequent releases, ~200 contributors), with an extensive functional test suite that runs the scanner against example files of known-bad code, plus CI across supported Python versions. API Design - Primarily a CLI tool: bandit -r ./project scans recursively, with flags for severity/confidence levels, plugin includes/excludes, baselines, and output formats. Configuration lives in pyproject.toml or a YAML file, and thorough Read-the-Docs documentation keeps onboarding straightforward.