Bandit (PyCQA)
Bandit is a free static analysis tool used to find common security issues in Python source code for Python developers and application security teams.
0 upvotes · 0 downvotes
No ratings yet
- Category
- Application Security
- Pricing
- Free
- Platforms
- LinuxWindowsmacOS
- License
- Open source
- Reviewed
- Last reviewed 25 October 2026
What it is
A Python package maintained by the Python Code Quality Authority that parses each file into a syntax tree and runs plugins against it. Findings come with a severity and a confidence rating.
What it helps with
- Flagging hardcoded passwords and weak cryptography
- Catching unsafe calls such as shell injection or insecure deserialization
- Gating pull requests in CI on new findings
- Setting a baseline so only new issues are reported
Who it's for
Python developers, DevSecOps engineers, and AppSec teams who review Python code.
Worth knowing
Individual lines can be excluded with a nosec comment, and tests or plugins can be selected or skipped in a config file. It can output JSON, SARIF, HTML, and other formats.
Does it scan languages other than Python?
No, it only analyzes Python code, and gosec is the comparable tool for Go.
How is it different from Semgrep?
In our view Bandit is the simpler drop-in choice for Python-only projects, while Semgrep covers many languages and makes custom rules easier.
Discussion & reviews
0 comments
No contributions yet. Be the first to review or comment.