What security issues does bandit find in Python code?

Its plugins flag hardcoded passwords, shell and command injection (subprocess with shell=True, os.system), weak crypto such as MD5 and insecure ciphers, unsafe deserialization (pickle, yaml.load), SQL string building, and assert use in production. Each finding carries a Bxxx test ID, a severity, and a confidence.

Does bandit detect hardcoded secrets?

It catches Python-level secrets. Tests B105 through B107 flag hardcoded password strings, function arguments, and default values. It is not a broad secret scanner across config files or other languages, so pair it with a dedicated secrets tool when you need full repository coverage.

How do I control which issues bandit reports?

Raise the severity floor with -l, -ll, or -lll for low, medium, or high, and filter by confidence with --confidence. Run a chosen set of plugins with --tests or drop noisy ones with --skip, both by test ID.

How does bandit handle # nosec comments?

By default bandit skips any line annotated with a # nosec comment, which lets developers suppress a reviewed finding inline. Pass --ignore-nosec to scan those lines anyway when you want a complete report regardless of inline suppressions.

Can I fail a build only on new findings?

Yes. Save a JSON report as a baseline, pass it with --baseline, and bandit reports only findings that are absent from it. Use --exit-zero to keep the process exit code at 0 when you want the workflow to continue and record results instead of stopping.

Updated Jul 14, 2026

Static Code Analysis

Scan Python code for security issues with AST plugins

Find common security issues in Python code.

Scan a Python repository for security bugs Gate a pipeline on new findings only Tune the noise with severity and test IDs

overview

What bandit does

bandit reads each Python file, builds an abstract syntax tree from it, and runs a set of security plugins against the tree nodes. That AST-level view lets it catch real risk patterns, the hardcoded passwords, shell injection, weak crypto calls, and unsafe deserialization that a text grep would miss or over-report.

Once it finishes a target, it assembles a report you can shape to a pipeline. Severity and confidence thresholds keep a run focused on issues that matter, a baseline file suppresses known findings so only new ones surface, and output formats from JSON to XML to HTML route results wherever triage lives.

On Trickest, bandit is a Static Code Analysis node that takes Python source as a file or folder and writes a file and a folder of findings. Run it on a repository and merge its output with dynamic scanner results for one view of code and runtime risk.

source github.com/PyCQA/bandit

use cases

Where bandit fits

Scan a Python repository for security bugs

Point bandit at a source folder with --recursive and let its plugins surface injection, weak crypto, and hardcoded secrets across the whole codebase.

Gate a pipeline on new findings only

Compare against a baseline JSON report with --baseline so previously accepted issues stay quiet and the run flags only fresh problems.

Tune the noise with severity and test IDs

Raise the severity floor with -ll or -lll and drop noisy plugins with --skip so a run returns the high-signal findings worth acting on.

Feed results into shared triage

Emit JSON or XML with -f and route bandit findings into the same table and reporting flow as dynamic scanner output for one risk view.

reference

bandit inputs and flags

23 inputs

Name	Type	Flag	Description
targets-folder	FOLDER	targets	Source folder to scan.
targets-file	FILE	targets	Source file(s) to scan.
recursive-target	FOLDER	--recursive	Find and process files in subdirectories.
output-format	STRING	-f	Output format: csv, custom, html, json, screen, txt, xml, or yaml.
level-medium	STRING	-ll	Report only issues at MEDIUM severity or higher (-l low, -lll high).
baseline	FILE	--baseline	Path of a baseline JSON report to compare against.
skip-id	STRING	--skip	Comma-separated list of test IDs to skip.
exit-zero	BOOLEAN	--exit-zero	Exit with 0 even when results are found.

Showing key inputs. bandit exposes 23 inputs in total.

Full flag reference (23 inputs)

Name	Type	Flag	Description
debug	BOOLEAN	-d	Turn on debug mode.
quiet	BOOLEAN	-q	Only show output in the case of an error.
profile	STRING	--profile	Profile to use (defaults to executing all tests).
skip-id	STRING	--skip	Comma-separated list of test IDs to skip.
test-id	STRING	--tests	Comma-separated list of test IDs to run.
verbose	BOOLEAN	--verbose	Output extra information like excluded and included files.
baseline	FILE	--baseline	Path of a baseline report to compare against (only JSON-formatted files are accepted).
ini-file	FILE	--ini	Path to a .bandit file that supplies command line arguments.
aggregate	STRING	--aggregate	Aggregate output by vulnerability (default) or by filename.
exit-zero	BOOLEAN	--exit-zero	Exit with 0, even when results are found.
level-low	STRING	-l	Report only issues at LOW severity or higher.
confidence	BOOLEAN	--confidence	Report only issues at a given confidence level or higher.
level-high	STRING	-lll	Report only issues at HIGH severity or higher.
config-file	FILE	--configfile	Optional config file to use for selecting plugins and overriding defaults.
ignore-nosec	BOOLEAN	--ignore-nosec	Do not skip lines with # nosec comments.
level-medium	STRING	-ll	Report only issues at MEDIUM severity or higher.
msg-template	STRING	--msg-template	Specify output message template (only usable when output-format is set to custom).
number-lines	STRING	--number	Maximum number of code lines to output for each issue.
targets-file	FILE	targets	Source file(s) to scan.
exclude-paths	STRING	--exclude	Comma-separated list of paths (glob patterns supported) to exclude from the scan, in addition to the config file excludes (default: .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg).
output-format	STRING	-f	Output format: csv, custom, html, json, screen, txt, xml, or yaml.
targets-folder	FOLDER	targets	Source folder to scan.
recursive-target	FOLDER	--recursive	Find and process files in subdirectories.

example

Run bandit

bandit · command

# recursively scan a source tree, medium severity and up, JSON reportbandit -r ./src -ll -f json -o findings.json

sample output

Run started:2026-07-14 09:12:03Test results:>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'changeme'   Severity: Low   Confidence: Medium   Location: ./src/config.py:14:14>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified.   Severity: High   Confidence: High   Location: ./src/tasks.py:52:8Code scanned: 1284 lines across 9 files, 2 issues (1 High, 1 Low)

guidance

Choosing bandit

Use bandit when the target is Python source, not a running app. It reasons about code, scanners test the deployed service, so pair both for coverage. For many languages with one engine, reach for semgrep instead.

semgrep

Pattern-based static analysis across many languages. bandit is Python-only but ships Python-specific plugins out of the box.

gosec

The equivalent security linter for Go. Same role, different language.

dawnscanner

Security scanner for Ruby web apps. A sibling for a different stack.

faq

bandit questions

Yes. bandit is a static application security testing tool for Python. It analyzes source without running it, parsing each file into an AST and matching security plugins against the tree, so it fits a SAST stage in a CI pipeline.

Run bandit yourself

Python source feeds bandit, which builds an AST, runs its security plugins, and writes the findings as a queryable output.

Run bandit in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

targets-folder

FOLDER

targets

Source folder to scan.

targets-file

FILE

targets

Source file(s) to scan.

recursive-target

FOLDER

--recursive

Find and process files in subdirectories.

output-format

STRING

-f

Output format: csv, custom, html, json, screen, txt, xml, or yaml.

level-medium

STRING

-ll

Report only issues at MEDIUM severity or higher (-l low, -lll high).

baseline

FILE

--baseline

Path of a baseline JSON report to compare against.

skip-id

STRING

--skip

Comma-separated list of test IDs to skip.

exit-zero

BOOLEAN

--exit-zero

Exit with 0 even when results are found.

Name

Type

Flag

Description

debug

BOOLEAN

-d

Turn on debug mode.

quiet

BOOLEAN

-q

Only show output in the case of an error.

profile

STRING

--profile

Profile to use (defaults to executing all tests).

skip-id

STRING

--skip

Comma-separated list of test IDs to skip.

test-id

STRING

--tests

Comma-separated list of test IDs to run.

verbose

BOOLEAN

--verbose

Output extra information like excluded and included files.

baseline

FILE

--baseline

Path of a baseline report to compare against (only JSON-formatted files are accepted).

ini-file

FILE

--ini

Path to a .bandit file that supplies command line arguments.

aggregate

STRING

--aggregate

Aggregate output by vulnerability (default) or by filename.

exit-zero

BOOLEAN

--exit-zero

Exit with 0, even when results are found.

level-low

STRING

-l

Report only issues at LOW severity or higher.

confidence

BOOLEAN

--confidence

Report only issues at a given confidence level or higher.

level-high

STRING

-lll

Report only issues at HIGH severity or higher.

config-file

FILE

--configfile

Optional config file to use for selecting plugins and overriding defaults.

ignore-nosec

BOOLEAN

--ignore-nosec

Do not skip lines with # nosec comments.

level-medium

STRING

-ll

Report only issues at MEDIUM severity or higher.

msg-template

STRING

--msg-template

Specify output message template (only usable when output-format is set to custom).

number-lines

STRING

--number

Maximum number of code lines to output for each issue.

targets-file

FILE

targets

Source file(s) to scan.

exclude-paths

STRING

--exclude

Comma-separated list of paths (glob patterns supported) to exclude from the scan, in addition to the config file excludes (default: .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg).

output-format

STRING

-f

Output format: csv, custom, html, json, screen, txt, xml, or yaml.

targets-folder

FOLDER

targets

Source folder to scan.

recursive-target

FOLDER

--recursive

Find and process files in subdirectories.

Run started:2026-07-14 09:12:03Test results:>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'changeme' Severity: Low Confidence: Medium Location: ./src/config.py:14:14>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified. Severity: High Confidence: High Location: ./src/tasks.py:52:8Code scanned: 1284 lines across 9 files, 2 issues (1 High, 1 Low)

Scan Python code for security issues with AST plugins

What bandit does

Where bandit fits

Scan a Python repository for security bugs

Gate a pipeline on new findings only

Tune the noise with severity and test IDs

Feed results into shared triage

bandit inputs and flags

Run bandit

Choosing bandit

semgrep

gosec

dawnscanner

bandit questions

More Static Code Analysis tools

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gitleaks

gosec

Run bandit yourself

Scan Python code for security issues with AST plugins

What bandit does

Where bandit fits

Scan a Python repository for security bugs

Gate a pipeline on new findings only

Tune the noise with severity and test IDs

Feed results into shared triage

bandit inputs and flags

Run bandit

Choosing bandit

semgrep

gosec

dawnscanner

bandit questions

More Static Code Analysis tools

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gitleaks

gosec

Run bandit yourself