CheckOps home

Tools directory

B

CheckOps

Bandit

Bandit is the PyCQA's Apache-2.0 tool for finding common security issues in Python code by building an AST for each file and running security plugins against it.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Bandit is a tool designed to find common security issues in Python code. It processes each file, builds an abstract syntax tree and runs plugins against the nodes, then produces a report. It is maintained by the Python Code Quality Authority (PyCQA).

The source code is at PyCQA/bandit on GitHub under the Apache-2.0 licence, with about 8,400 stars; the most recent commit was on 9 November 2026.

Features

  1. Python security checks: Flags issues such as hard-coded passwords, unsafe deserialisation, shell injection and weak crypto.
  2. Plugins: Extensible test plugins.
  3. Severity and confidence: Each finding is rated.
  4. Baselines and config: Skip tests and suppress known issues.
  5. CI friendly: Several output formats, including JSON and SARIF via options; see docs.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 9 November 2026.
  3. Community: About 8,400 GitHub stars.

Cons

  1. Python only: Other languages need other tools.
  2. Pattern-based: Limited data-flow analysis; expect some false positives.
pip install bandit
bandit -r ./src -ll

Resources:

Pricing

Bandit is free and open source under the Apache-2.0 licence.

  1. Python teams adding a quick security lint to CI.
  2. Reviewers wanting automated checks for common pitfalls.
  3. Not a fit for deep cross-file taint analysis.

Conclusion

Bandit is a lightweight, widely used security linter for Python.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Bandit side by side.