add bandit tests to app

ci/test.sh

@@ -4,4 +4,5 @@ set -euo pipefail
 shopt -s inherit_errexit
 
 src/dev set-up-environment
+bandit -r kibana_cf_auth_proxy
 src/dev test

dev-requirements.txt

@@ -2,10 +2,12 @@
 # This file is autogenerated by pip-compile
 # To update, run:
 #
-#    pip-compile --output-file=dev-requirements.txt pip-tools/dev-requirements.in
+#    ./dev update-requirements
 #
 attrs==20.3.0
     # via pytest
+bandit==1.7.0
+    # via -r pip-tools/dev-requirements.in
 cachelib==0.1.1
     # via
     #   -r pip-tools/../requirements.txt
@@ -35,6 +37,10 @@ flask==1.1.2
     # via
     #   -r pip-tools/../requirements.txt
     #   flask-session
+gitdb==4.0.7
+    # via gitpython
+gitpython==3.1.14
+    # via bandit
 greenlet==1.0.0
     # via playwright
 gunicorn==20.0.4
@@ -48,6 +54,7 @@ importlib-metadata==3.7.3
     #   pep517
     #   pluggy
     #   pytest
+    #   stevedore
 iniconfig==1.1.1
     # via pytest
 itsdangerous==1.1.0
@@ -68,6 +75,8 @@ marshmallow==3.10.0
     #   environs
 packaging==20.9
     # via pytest
+pbr==5.5.1
+    # via stevedore
 pep517==0.10.0
     # via pip-tools
 pip-tools==6.0.1
@@ -104,6 +113,8 @@ python-dotenv==0.15.0
     # via
     #   -r pip-tools/../requirements.txt
     #   environs
+pyyaml==5.4.1
+    # via bandit
 redis==3.5.3
     # via -r pip-tools/../requirements.txt
 requests-mock==1.8.0
@@ -114,7 +125,13 @@ requests==2.25.1
     #   pytest-base-url
     #   requests-mock
 six==1.15.0
-    # via requests-mock
+    # via
+    #   bandit
+    #   requests-mock
+smmap==4.0.0
+    # via gitdb
+stevedore==3.3.0
+    # via bandit
 toml==0.10.2
     # via
     #   pep517

pip-tools/dev-requirements.in

@@ -1,4 +1,5 @@
 -r ../requirements.txt
+bandit
 pip-tools
 playwright
 pyotp

requirements.txt

@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile
 # To update, run:
 #
-#    pip-compile --output-file=requirements.txt pip-tools/requirements.in
+#    ./dev update-requirements
 #
 cachelib==0.1.1
     # via flask-session