Skip to content
/ bandit Public

Bandit is a tool designed to find common security issues in Python code.

License

Notifications You must be signed in to change notification settings

PyCQA/bandit

Folders and files

NameName
Last commit message
Last commit date

Latest commit

e4da0b3 · Jan 7, 2025
Jan 7, 2025
Jan 7, 2025
Oct 7, 2024
Jan 23, 2024
Jan 7, 2025
Apr 22, 2024
Jan 22, 2022
Jan 7, 2025
Jan 29, 2022
Dec 24, 2024
Jun 15, 2023
Oct 7, 2024
Nov 13, 2024
Mar 22, 2020
Apr 13, 2023
Jan 22, 2022
Dec 6, 2024
Jan 13, 2024
Mar 5, 2022
Oct 30, 2024
Apr 6, 2023
Jan 21, 2024
Oct 21, 2024
Oct 7, 2024
Jan 21, 2024
Nov 13, 2024

Bandit


Build Status Docs Status Latest Version Python Versions Format License Discord

A security linter from PyCQA

Overview

Bandit is a tool designed to find common security issues in Python code. To do this Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. Once Bandit has finished scanning all the files it generates a report.

Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA.

Bandit Example Screen Shot

Show Your Style

Security Status

Use our badge in your project's README!

using Markdown:

[![security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)

using RST:

.. image:: https://img.shields.io/badge/security-bandit-yellow.svg
    :target: https://github.com/PyCQA/bandit
    :alt: Security Status

References

Python AST module documentation: https://docs.python.org/3/library/ast.html

Green Tree Snakes - the missing Python AST docs: https://greentreesnakes.readthedocs.org/en/latest/

Documentation of the various types of AST nodes that Bandit currently covers or could be extended to cover: https://greentreesnakes.readthedocs.org/en/latest/nodes.html

Container Images

Bandit is available as a container image, built within the bandit repository using GitHub Actions. The image is available on ghcr.io:

docker pull ghcr.io/pycqa/bandit/bandit

The image is built for the following architectures:

  • amd64
  • arm64
  • armv7
  • armv8

To pull a specific architecture, use the following format:

docker pull --platform=<architecture> ghcr.io/pycqa/bandit/bandit:latest

Every image is signed with sigstore cosign and it is possible to verify the source of origin using the following cosign command:

cosign verify ghcr.io/pycqa/bandit/bandit:latest \
  --certificate-identity https://github.com/pycqa/bandit/.github/workflows/build-publish-image.yml@refs/tags/<version> \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Where <version> is the release version of Bandit.

Sponsors

The development of Bandit is made possible by the following sponsors:

Mercedes-Benz Tidelift Stacklok

If you also ❤️ Bandit, please consider sponsoring.