Security oriented static analyser for python code.
npx @tessl/cli install tessl/pypi-bandit@1.8.0A security-oriented static analysis tool designed to find common security issues in Python code. Bandit processes AST representations of Python source code and runs security-focused plugins against AST nodes to identify potential vulnerabilities including hardcoded passwords, SQL injection, shell injection, and weak cryptographic implementations.
pip install banditpip install bandit[yaml,toml,baseline,sarif] for additional featuresimport bandit
from bandit.core import manager, config, context, issueFor CLI usage:
from bandit.cli import mainFor programmatic usage:
from bandit.core.manager import BanditManager
from bandit.core.config import BanditConfig# Scan a single file
bandit example.py
# Scan a directory recursively
bandit -r /path/to/project
# Generate JSON report
bandit -r /path/to/project -f json -o report.json
# Exclude specific tests
bandit -r /path/to/project --skip B101,B601
# Use baseline to ignore existing issues
bandit-baseline -r /path/to/project -o baseline.json
bandit -r /path/to/project -b baseline.jsonfrom bandit.core import manager, config
# Create configuration
conf = config.BanditConfig()
# Create manager
b_mgr = manager.BanditManager(conf, 'file')
# Discover and scan files
b_mgr.discover_files(['/path/to/code'])
b_mgr.run_tests()
# Get filtered results
issues = b_mgr.get_issue_list(sev_level='MEDIUM', conf_level='HIGH')
# Print results
for issue in issues:
print(f"{issue.fname}:{issue.lineno} - {issue.text}")Bandit's plugin-based architecture enables extensible security analysis:
BanditManager) that coordinates scanning workflowBanditConfig)Context)Issue, Cwe)Central scanning orchestration and configuration management. The BanditManager coordinates file discovery, test execution, and result filtering, while BanditConfig handles YAML configuration files and scanning profiles.
class BanditManager:
def __init__(self, config, agg_type, debug=False, verbose=False, quiet=False, profile=None, ignore_nosec=False): ...
def discover_files(self, targets, recursive=False): ...
def run_tests(self): ...
def get_issue_list(self, sev_level='LOW', conf_level='LOW'): ...
class BanditConfig:
def __init__(self, config_file=None): ...
def get_option(self, option_string): ...
def get_setting(self, setting_name): ...Comprehensive security issue representation with Common Weakness Enumeration (CWE) support. Issues include severity levels, confidence ratings, source code context, and structured metadata for integration with security tools.
class Issue:
def __init__(self, severity, cwe=0, confidence='UNDEFINED', text="", ident=None, lineno=None, test_id="", col_offset=-1, end_col_offset=0): ...
def filter(self, severity, confidence): ...
def get_code(self, max_lines=3, tabbed=False): ...
def as_dict(self, with_code=True, max_lines=3): ...
class Cwe:
def __init__(self, id=999): ...
def link(self): ...
def as_dict(self): ...AST node analysis and import tracking during security test execution. Context provides access to function call information, string literals, and module import patterns essential for accurate vulnerability detection.
class Context:
def __init__(self, context_object=None): ...
@property
def call_function_name(self): ...
@property
def call_function_name_qual(self): ...
@property
def call_args(self): ...
@property
def call_keywords(self): ...
def is_module_being_imported(self, module): ...Framework for creating custom security tests using decorators and the plugin registration system. Supports AST node type filtering, configuration integration, and test identification.
def checks(*args): ...
def test_id(id_val): ...
def takes_config(name=None): ...
def accepts_baseline(*args): ...Multiple report formats for different use cases and CI/CD integration. Formatters support severity filtering, confidence thresholds, and baseline comparison for security reporting workflows.
def report(manager, fileobj, sev_level, conf_level, lines): ...Available formatters: JSON, XML, HTML, SARIF, CSV, YAML, screen, custom template-based
Three CLI utilities for security scanning, configuration management, and baseline handling in development and CI/CD environments.
bandit [options] targets...
bandit-config-generator [options]
bandit-baseline [options] targets...Plugin system management for loading and validating security tests, formatters, and blacklist handlers. Provides centralized plugin registry and validation.
class Manager:
def __init__(self, formatters_namespace="bandit.formatters", plugins_namespace="bandit.plugins", blacklists_namespace="bandit.blacklists"): ...
def load_formatters(self, formatters_namespace): ...
def load_plugins(self, plugins_namespace): ...
def validate_profile(self, profile): ...
def get_plugin_by_id(self, plugin_id): ...
# Global plugin manager instance
MANAGER = ... # Available from bandit.core.extension_loaderAST analysis and code inspection utilities for security test development and advanced usage.
def get_call_name(node, aliases): ... # Extract function call name with alias resolution
def get_func_name(node): ... # Get function name from AST node
def get_qual_attr(node, aliases): ... # Get qualified attribute with aliases
def deepgetattr(obj, attr): ... # Deep attribute access with dot notation
def check_ast_node(node_type): ... # Validate AST node type# Severity and confidence levels
HIGH = "HIGH"
MEDIUM = "MEDIUM"
LOW = "LOW"
UNDEFINED = "UNDEFINED"
# Ranking values for filtering
RANKING_VALUES = {
"UNDEFINED": 1,
"LOW": 3,
"MEDIUM": 5,
"HIGH": 10
}
# File exclusion patterns
EXCLUDE = (".svn", "CVS", ".bzr", ".hg", ".git", "__pycache__", ".tox", ".eggs", "*.egg")
# Values considered false in static analysis
FALSE_VALUES = [None, False, "False", 0, 0.0, 0j, "", (), [], {}]
# Default confidence level
CONFIDENCE_DEFAULT = "UNDEFINED"