diff --git a/.bandit b/.bandit
index e88cede2b84..99fa7b4c909 100644
--- a/.bandit
+++ b/.bandit
@@ -7,8 +7,6 @@
 ### in both 'tests' and 'skips', this would be nonsensical and is detected by
 ### Bandit at runtime.
 
-exclude: /cmake/cpplint
-
 # Available tests:
 # B101 : assert_used
 # B102 : exec_used
diff --git a/ci/check-basics.py b/ci/check-basics.py
index a2d18ae4ed9..2ae3bad4882 100755
--- a/ci/check-basics.py
+++ b/ci/check-basics.py
@@ -150,7 +150,8 @@ def complain(message):
         all_passed = False
 
     print('running bandit...', flush=True)
-    if subprocess.run([sys.executable, '-m', 'bandit', '.', '-r', '-c', '.bandit'], cwd=OMZ_ROOT).returncode != 0:
+    if subprocess.run([sys.executable, '-m', 'bandit', '.', '-r', '-c', '.bandit',
+        '--exclude', './cmake/cpplint/cpplint.py'], cwd=OMZ_ROOT).returncode != 0:
         all_passed = False
 
     print('running documentation checks...', flush=True)
diff --git a/cmake/cpplint/cpplint.py b/cmake/cpplint/cpplint.py
old mode 100755
new mode 100644