Bandit is a security-focused static analysis tool designed to identify potentially dangerous programming practices in Python source code. Originally developed within the OpenStack Security Project, it is maintained by the Python Code Quality Authority.
The application examines the structure of Python programs using abstract syntax trees. Its checks look for programming patterns that may introduce security weaknesses, such as unsafe command execution, insecure deserialisation and unsuitable cryptographic operations.
Bandit is intended to help developers identify code that deserves further security review. Its findings do not necessarily indicate exploitable vulnerabilities, as some programming patterns may be appropriate in particular circumstances. The tool is therefore most effective when used alongside testing, code review and other security assessment methods.
This is free and open source software.
Key Features
- Uses abstract syntax tree analysis to examine security-sensitive Python programming patterns.
- Detects potentially unsafe subprocess usage, including shell execution involving untrusted input.
- Identifies hard-coded credentials, insecure deserialisation functions and weak cryptographic algorithms.
- Assigns severity and confidence ratings to findings to help developers prioritise investigation.
- Supports configurable collections of checks and exclusions for different projects.
- Allows selected findings to be suppressed where the associated behaviour has been reviewed.
- Provides baseline support for distinguishing existing security findings from newly introduced problems.
- Generates reports in formats including JSON, HTML, XML, CSV and SARIF.
- Integrates with pre-commit hooks and continuous integration pipelines.
Website: github.com/PyCQA/bandit
Support:
Developer: Python Code Quality Authority
License: Apache License 2.0
Bandit is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Python Linters | |
|---|---|
| Ruff | Extremely fast Python linter and code formatter |
| ty | Fast Python type checker |
| Mypy | Static type checker for Python |
| Bandit | Find security issues in Python code |
| Pylint | Static code analyser |
| wemake-python-styleguide | Flake8 plugin |
| Tach | Enforces module dependencies and architectural boundaries |
| pycodestyle | Check Python code against style conventions in PEP 8 |
| Pyflakes | Checks Python source files for errors |
| Vulture | Find dead code |
| Pyrefly | Fast type checker and language server |
| Flake8 | Wrapper around PyFlakes and pycodestyle |
| Beartype | Near-real-time hybrid runtime-static type-checker |
| Radon | Computes various metrics from Python code |
| Pyright | Full-featured, standards-compliant static type checker |
| cython-lint | Lint Cython files |
| basedpyright | Fork of pyright |
| Refurb | Modernize Python codebases |
| Pylama | Code audit tool for Python |
| Prospector | Brings together the functionality of other Python analysis tools |
| deptry | Check for dependency issues |
| Fixit | Highly configurable linting framework |
| complexipy | Measures cognitive complexity in Python code |
| Zuban | High-performance Python type checker and language server |
| Pyroma | Rates how well a Python project compiles |
| pydoclint | Python docstring linter |
| Arid | Fast duplicate code detection for Python projects |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.