Does bandit detect hardcoded secrets?

It catches Python-level secrets. Tests B105 through B107 flag hardcoded password strings, function arguments, and default values. It is not a broad secret scanner across config files or other languages, so pair it with a dedicated secrets tool for full repository coverage.

How do I control which issues bandit reports?

Raise the severity floor with -l, -ll, or -lll. Filter by confidence with --confidence. Run a chosen set of plugins with --tests or drop noisy ones with --skip, both by test ID.

How does bandit handle # nosec comments?

By default bandit skips any line annotated with # nosec, so developers can suppress a reviewed finding inline. Pass --ignore-nosec to scan those lines anyway when you want a complete report.

Can I fail a build only on new findings?

Yes. Save a JSON report as a baseline, pass it with --baseline, and bandit reports only findings absent from it. Use --exit-zero to keep exit code 0 when the workflow should continue and record results instead of stopping.

How do I scan a whole repository?

Point targets at the source tree and enable --recursive so bandit walks subdirectories. Emit machine-readable output with -f json or -f xml for CI triage.

Updated Jul 14, 2026

Static Code Analysis

Catch Python security bugs from the AST

AST-based security checks for Python source.

Scan a Python repository for security bugs Gate a pipeline on new findings only Tune the noise with severity and test IDs

overview

What bandit does

bandit reads Python source, builds an AST, and runs security plugins against the nodes. That catches hardcoded passwords, shell injection, weak crypto, and unsafe deserialization that a text grep misses or over-reports.

Tune the run: -ll or -lll set a severity floor, --skip drops noisy test IDs, --baseline keeps only new findings, and -f chooses csv, json, xml, html, and other report shapes.

Trickest provides bandit as a managed Static Code Analysis node. Feed a FILE or FOLDER of Python source, often with --recursive; it writes FILE and FOLDER findings for triage or merge with dynamic scanner output.

source github.com/PyCQA/bandit

use cases

Where bandit fits

Scan a Python repository for security bugs

Point bandit at a source folder with --recursive and let its plugins surface injection, weak crypto, and hardcoded secrets across the whole codebase.

Gate a pipeline on new findings only

Compare against a baseline JSON report with --baseline so previously accepted issues stay quiet and the run flags only fresh problems.

Tune the noise with severity and test IDs

Raise the severity floor with -ll or -lll and drop noisy plugins with --skip so a run returns the high-signal findings worth acting on.

Feed results into shared triage

Emit JSON or XML with -f and route bandit findings into the same table and reporting flow as dynamic scanner output for one risk view.

reference

bandit inputs and flags

23 inputs

Name	Type	Flag	Description
targets-folder	FOLDER	targets	Source folder to scan.
targets-file	FILE	targets	Source file(s) to scan.
recursive-target	FOLDER	--recursive	Find and process files in subdirectories.
output-format	STRING	-f	Output format: csv, custom, html, json, screen, txt, xml, or yaml.
level-medium	STRING	-ll	Report only issues at MEDIUM severity or higher (-l low, -lll high).
baseline	FILE	--baseline	Path of a baseline JSON report to compare against.
skip-id	STRING	--skip	Comma-separated list of test IDs to skip.
exit-zero	BOOLEAN	--exit-zero	Exit with 0 even when results are found.

Showing key inputs. bandit exposes 23 inputs in total.

Full flag reference (23 inputs)

Name	Type	Flag	Description
debug	BOOLEAN	-d	Turn on debug mode.
quiet	BOOLEAN	-q	Only show output in the case of an error.
profile	STRING	--profile	Profile to use (defaults to executing all tests).
skip-id	STRING	--skip	Comma-separated list of test IDs to skip.
test-id	STRING	--tests	Comma-separated list of test IDs to run.
verbose	BOOLEAN	--verbose	Output extra information like excluded and included files.
baseline	FILE	--baseline	Path of a baseline report to compare against (only JSON-formatted files are accepted).
ini-file	FILE	--ini	Path to a .bandit file that supplies command line arguments.
aggregate	STRING	--aggregate	Aggregate output by vulnerability (default) or by filename.
exit-zero	BOOLEAN	--exit-zero	Exit with 0, even when results are found.
level-low	STRING	-l	Report only issues at LOW severity or higher.
confidence	BOOLEAN	--confidence	Report only issues at a given confidence level or higher.
level-high	STRING	-lll	Report only issues at HIGH severity or higher.
config-file	FILE	--configfile	Optional config file to use for selecting plugins and overriding defaults.
ignore-nosec	BOOLEAN	--ignore-nosec	Do not skip lines with # nosec comments.
level-medium	STRING	-ll	Report only issues at MEDIUM severity or higher.
msg-template	STRING	--msg-template	Specify output message template (only usable when output-format is set to custom).
number-lines	STRING	--number	Maximum number of code lines to output for each issue.
targets-file	FILE	targets	Source file(s) to scan.
exclude-paths	STRING	--exclude	Comma-separated list of paths (glob patterns supported) to exclude from the scan, in addition to the config file excludes (default: .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg).
output-format	STRING	-f	Output format: csv, custom, html, json, screen, txt, xml, or yaml.
targets-folder	FOLDER	targets	Source folder to scan.
recursive-target	FOLDER	--recursive	Find and process files in subdirectories.

example

Run bandit

bandit · command

# recursively scan a source tree, medium severity and up, JSON reportbandit -r ./src -ll -f json -o findings.json

sample output

Run started:2026-07-14 09:12:03Test results:>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'changeme'   Severity: Low   Confidence: Medium   Location: ./src/config.py:14:14>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified.   Severity: High   Confidence: High   Location: ./src/tasks.py:52:8Code scanned: 1284 lines across 9 files, 2 issues (1 High, 1 Low)

guidance

Choosing bandit

Use bandit when the target is Python source, not a running app. It reasons about code; dynamic scanners test the deployed service, so pair both for coverage. For many languages with one engine, reach for semgrep instead.

semgrep

Pattern-based static analysis across many languages. bandit is Python-only and ships Python-specific plugins out of the box.

gosec

Equivalent security linter for Go. Same role, different language.

dawnscanner

Security scanner for Ruby web apps. Sibling tool for a different stack.

faq

bandit questions

Plugins flag hardcoded passwords, shell and command injection (subprocess with shell=True, os.system), weak crypto such as MD5, unsafe deserialization (pickle, yaml.load), SQL string building, and assert use in production. Each finding carries a Bxxx test ID, severity, and confidence.

Run bandit yourself

Python source feeds bandit, which builds an AST, runs its security plugins, and writes the findings as a queryable output.

Run bandit in Trickest Browse the library

Facts on this page come from the live Trickest tool library.

Catch Python security bugs from the AST

What bandit does

Where bandit fits

Scan a Python repository for security bugs

Gate a pipeline on new findings only

Tune the noise with severity and test IDs

Feed results into shared triage

bandit inputs and flags

Run bandit

Choosing bandit

semgrep

gosec

dawnscanner

bandit questions

More Static Code Analysis tools

gitleaks

gosec

secretfinder

semgrep-scan

trufflehog

dawnscanner

Run bandit yourself