{"id":1088,"library":"bandit","title":"Bandit","description":"Bandit is an open-source security-oriented static analyser for Python code, designed to find common security issues early in the development lifecycle. It processes each file, builds an Abstract Syntax Tree (AST) from it, and runs a set of security-focused plugins against the AST nodes, generating reports with severity and confidence levels. Maintained by the PyCQA community, Bandit is currently at version 1.9.4 and requires Python >=3.10. Its release cadence focuses on compatibility updates and rule maintenance, indicating a stable and actively supported utility.","status":"active","version":"1.9.4","language":"python","source_language":"en","source_url":"https://github.com/PyCQA/bandit","tags":["security","static analysis","linter","code quality","devsecops"],"install":[{"cmd":"pip install bandit","lang":"bash","label":"Core Installation"},{"cmd":"pip install bandit[toml]","lang":"bash","label":"With TOML configuration support"},{"cmd":"pip install bandit[baseline]","lang":"bash","label":"With baseline report support"}],"dependencies":[],"imports":[],"quickstart":{"code":"# Save this as vulnerable_app.py\nimport os\nimport subprocess\n\ndef execute_command(command_str):\n    # B602: subprocess_popen_with_shell_equals_true - High severity, high confidence\n    subprocess.call(command_str, shell=True) \n\ndef process_user_input(user_input):\n    # B307: eval - High severity, high confidence\n    eval(user_input)\n\nif __name__ == \"__main__\":\n    print(\"Creating a dummy vulnerable file for Bandit scan.\")\n    with open(\"dummy_code.py\", \"w\") as f:\n        f.write(\"import subprocess\\n\")\n        f.write(\"command = os.environ.get('UNSAFE_COMMAND', 'ls -l')\\n\")\n        f.write(\"subprocess.call(command, shell=True)\\n\")\n\n    print(\"Now run Bandit from your terminal:\")\n    print(\"bandit -r .\\n\")\n    print(\"Or specifically on the dummy file:\")\n    print(\"bandit dummy_code.py\\n\")\n    print(\"Example output will show security issues like B602.\")\n\n# To clean up after running:\n# os.remove(\"dummy_code.py\")\n","lang":"python","description":"Bandit is primarily a command-line tool. To quickly scan your code for security issues, you first create a Python file, and then run Bandit against it. This example creates a dummy file with common vulnerabilities and instructs on how to run Bandit."},"warnings":[{"fix":"Avoid `shell=True`. Instead, pass commands and arguments as a list (e.g., `subprocess.call(['ls', '-l'])`). If `shell=True` is unavoidable, ensure all user-supplied input is rigorously sanitized.","message":"Using `subprocess` calls with `shell=True` (e.g., `subprocess.call(command, shell=True)`) is a major security vulnerability (B602) if the `command` string is derived from untrusted input, as it enables shell injection attacks.","severity":"breaking","affected_versions":"All versions"},{"fix":"Replace `assert` statements used for critical logic with proper exception handling (e.g., `raise ValueError(...)` or `raise AssertionError(...)`).","message":"The Python `assert` statement (B101) should not be used for security-critical checks or enforcing interface constraints in production code. Asserts are removed when Python is run with optimizations (`python -O`), which can bypass security controls.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Review each reported issue carefully. Use inline comments like `# nosec` to suppress specific findings that are confirmed false positives or acceptable risks, documenting the reason for suppression.","message":"Bandit can produce false positives, requiring manual review of reported issues. The tool's output provides severity and confidence levels to help prioritize findings, but human judgment is still necessary.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Integrate Bandit into your CI/CD pipeline for comprehensive scans on pull requests or merges. For local development, consider running it less frequently, targeting specific files, or configuring it to only fail on high-severity issues.","message":"Running Bandit recursively on large codebases can be time-consuming and impact development workflow if integrated as a blocking pre-commit hook for every change.","severity":"gotcha","affected_versions":"All versions"},{"fix":"For YAML or TOML configurations, always run Bandit with `bandit -c your_config.yaml -r .` or `bandit -c pyproject.toml -r .`. Ensure the configuration file path is correct.","message":"When using configuration files (`.bandit`, `bandit.yaml`, `pyproject.toml`), only `.bandit` (INI format) is automatically discovered when running `bandit -r`. For YAML or TOML files, you must explicitly specify them using the `-c` flag.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'1.9.4':69 '3.10':73 'abstract':33 'activ':88 'analys':12 'analysi':93 'ast':36,50 'bandit':1,2,64 'build':31 'cadenc':76 'code':15,95 'common':19 'communiti':63 'compat':79 'confid':57 'current':66 'design':16 'develop':25 'devsecop':97 'earli':22 'file':30 'find':18 'focus':46,77 'generat':52 'indic':84 'issu':21 'level':58 'lifecycl':26 'linter':94 'maintain':59 'mainten':83 'node':51 'open':6 'open-sourc':5 'orient':10 'plugin':47 'process':28 'pycqa':62 'python':14,72 'qualiti':96 'releas':75 'report':53 'requir':71 'rule':82 'run':40 'secur':9,20,45,91 'security-focus':44 'security-ori':8 'set':42 'sever':55 'sourc':7 'stabl':86 'static':11,92 'support':89 'syntax':34 'tree':35 'updat':80 'util':90 'version':68","created_at":"2026-04-05T13:05:11.544288+00:00","updated_at":"2026-04-15T23:51:58.396584+00:00","problems":[{"fix":"Install Bandit using pip: `pip install bandit`","cause":"The Bandit package has not been installed in the current Python environment, or the Python environment where it's installed is not active.","error":"ModuleNotFoundError: No module named 'bandit'"},{"fix":"Ensure Bandit is installed (`pip install bandit`) and verify that the directory containing the `bandit` executable (e.g., `~/.local/bin` or a virtual environment's `bin` directory) is in your system's PATH. You might need to reactivate your virtual environment or restart your terminal.","cause":"The `bandit` executable is not found in the system's PATH, usually because it wasn't installed or its installation directory is not included in the PATH environment variable.","error":"command not found: bandit"},{"fix":"Install the `pbr` package: `pip install pbr`. Alternatively, update Bandit to a more recent version where this dependency issue might be resolved or managed differently: `pip install --upgrade bandit`.","cause":"This error typically occurs with older versions of Bandit (e.g., 1.7.0) due to a missing `pbr` dependency, which was an indirect dependency via `stevedore` and might not have been explicitly installed or declared in certain setups.","error":"ModuleNotFoundError: No module named 'pbr'"},{"fix":"Specify the severity or confidence level using the correct flag and format, typically in lowercase and without the level name directly as an argument, e.g., `bandit examples/*.py --severity-level high` or `bandit examples/*.py --confidence-level medium`.","cause":"Users often provide severity or confidence levels (like 'LOW', 'MEDIUM', 'HIGH') incorrectly as direct arguments instead of using the expected syntax for `--severity-level` or `--confidence-level` flags.","error":"bandit: error: unrecognized arguments: LOW"},{"fix":"Ensure that the Python version used to run Bandit is compatible with the Python code being analyzed. If your project uses Python 3.10+, run Bandit with a Python 3.10+ interpreter. For example, if you are scanning a Python 3.7 project, you should run Bandit with a Python 3.7 interpreter. Consider using a virtual environment to manage Python versions. Update Bandit to the latest version if there are compatibility concerns: `pip install --upgrade bandit`.","cause":"This generic error can appear when Bandit encounters syntax errors in the scanned Python code that are incompatible with the Python interpreter version Bandit is running on, or when the Bandit version itself is not compatible with the Python version it's analyzing. Bandit 1.9.4 requires Python >=3.10.","error":"Error: Process completed with exit code 1."}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"bandit","cli_version":"bandit 1.9.4","type":"library","homepage":"https://bandit.readthedocs.io/","github":"https://github.com/PyCQA/bandit","docs":"https://bandit.readthedocs.io/","changelog":"https://github.com/PyCQA/bandit/releases","pypi":"https://pypi.org/project/bandit/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["devops","testing"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-04-05","next_check":"2026-07-04","install_tag":null}}