Bandit Cheat Sheet

Bandit cheat sheet

Bandit (PyCQA) is a static security analyzer for Python. It parses your code into an AST and runs plugins that flag common weaknesses — eval/exec, shell=True, hardcoded passwords, weak crypto (md5), unsafe pickle/yaml.load, SQL built by string concat, requests with TLS verification off, and more. Each finding carries a test id (B###), a severity, and a confidence. Runs from the CLI, pre-commit, or CI, and emits JSON/SARIF for code scanning. Targets Bandit 1.9.x, Python 3.10+.

install & run understanding results configuration suppression & CI limits & ecosystem gotcha ★ most common

Verified 2026-08-31 against the official docs at bandit.readthedocs.io & the PyCQA/bandit repo (Bandit 1.9.4, released 2026-02-26; Python 3.10–3.14). Findings are advisory — Bandit catches common patterns, not all vulnerabilities; expect false positives and triage them.

Outline

Point bandit -r at your source, read the severity/confidence + B### ids, then configure what to scan, suppress false positives, baseline legacy code, and wire it into CI.

1Install & first scanpip / extras

pip install bandit★
Extras: bandit[toml] (read config from pyproject.toml), bandit[sarif] (SARIF output), bandit[baseline]. Python 3.10+.
bandit -r ./src★
The one command you need: -r recurses a directory. Scans all .py files and prints findings grouped by severity.
bandit myfile.py
Scan a single file (no -r needed). bandit --version, bandit --help.
bandit -r . -x './tests,./.venv'★
-x/--exclude skips paths (comma-separated globs). Exclude tests, venvs, and vendored code.

2Running banditthe useful flags

bandit -r src -ll # report only MEDIUM+ severity★
-l/-ll/-lll raise the minimum severity to report (LOW/MEDIUM/HIGH). Cuts noise fast.
bandit -r src -ii # report only MEDIUM+ confidence★
-i/-ii/-iii raise the minimum confidence. Combine with -ll to focus on high-signal findings.
bandit -r src -q # quiet: only show findings
-q suppresses the per-file progress; -v for verbose. --exit-zero to never fail the process.
bandit -r src -n 3 # lines of context around each issue
-n sets how many code lines print around each finding.
# bandit exits non-zero when it finds issues — good for CInote
A non-zero exit fails the build. Use --severity-level/--confidence-level or a baseline to control what counts.

3Severity & confidencetriage

# each finding: Severity (LOW/MED/HIGH) + Confidence (LOW/MED/HIGH)★
Severity = how bad if real; Confidence = how sure Bandit is it's real. Triage High severity + High confidence first.
>> Issue: [B602:subprocess_popen_with_shell_equals_true] Severity: High Confidence: High Location: app.py:42★
Each finding shows the test id + name, both ratings, the file:line, a CWE link, and the offending code.
# low confidence often = false positive — verify before "fixing"
A low-confidence hit may be safe in context. Read the code; don't blindly change working code to silence Bandit.

4Common checks (B###)what it flags

B602 subprocess(..., shell=True) · B605 os.system★
Shell/command injection risks — the highest-value category. Pass args as a list & avoid shell=True.
B301 pickle · B307 eval · B506 yaml.load · B310 urlopen
Unsafe deserialization / dynamic exec. Use yaml.safe_load, avoid eval/pickle on untrusted input.
B105 hardcoded_password_string · B106/B107 in funcs/defaults
Hardcoded secrets in code or default args. Move to env vars / a secrets manager.
B303 md5 · B324 hashlib weak hash · B501 requests verify=False
Weak crypto & disabled TLS. Use SHA-256+, keep certificate verification on.
B101 assert_used · B608 hardcoded_sql_expressions
B101: assert is stripped under python -O (don't use it for security checks). B608: SQL built by string concat → parameterize.

5Output formats-f / -o

bandit -r src -f json -o report.json★
-f format, -o output file. Formats: screen (default), json, sarif, html, csv, xml, yaml, txt.
bandit -r src -f sarif -o bandit.sarif★
SARIF feeds GitHub code scanning & other security dashboards (needs bandit[sarif]).
bandit -r src -f html -o report.html
A shareable HTML report for humans; JSON for tooling/baselines.

8# nosec suppressioninline waivers

subprocess.run(cmd, shell=True) # nosec★
A # nosec comment on the line waives all Bandit findings there. Use sparingly, for verified-safe code.
os.system(cmd) # nosec B605★
Scope the waiver to specific test ids — safer than a blanket # nosec that could hide new issues.
# always comment WHY next to a nosec — reviewers need the reasontip
A bare # nosec is a code smell in review. Add justification: # nosec B605 - input is a fixed constant.

9Baselineonly new issues

bandit -r src -f json -o baseline.json★
Snapshot the current findings of a legacy codebase into a baseline file (needs bandit[baseline]).
bandit -r src -b baseline.json★
-b/--baseline reports only findings not in the baseline — so CI fails on new issues without demanding you fix everything at once.
# regenerate the baseline as you burn down existing findings
Shrink the baseline over time. Commit it so the whole team shares the same "known issues" set.

10CI & pre-commitautomate it

# .pre-commit-config.yaml - repo: https://github.com/PyCQA/bandit hooks: [{id: bandit, args: ["-c", "pyproject.toml"]}]★
Run Bandit on every commit via pre-commit so issues never reach the repo.
# GitHub Actions - run: bandit -r . -f sarif -o bandit.sarif --exit-zero - uses: github/codeql-action/upload-sarif@v3★
Emit SARIF and upload it to GitHub code scanning — findings show up in the Security tab & on PRs.
bandit -r src -ll -ii -b baseline.json # the CI gate
A common gate: fail only on new MEDIUM+ severity, MEDIUM+ confidence issues.

Worth memorizing

bandit -r ./srcrecursive scan — the core command

-x tests,.venvexclude paths

-ll / -iimin severity / confidence — cut noise

severity × confidencetriage high×high first

B602/B605shell=True / os.system (injection)

B301/B307/B506pickle / eval / yaml.load

B105 / B303 / B501secrets / md5 / verify=False

-f sarif / json / htmloutput formats (-o file)

-s / -tskip / run-only test ids

# nosec B605scoped waiver — comment why

-b baseline.jsonfail only on NEW issues

scans your code, not depsadd pip-audit / Safety

Bandit cheat sheet

Outline

Install & run

Understanding results

Configuration

Suppression & CI

Limits & ecosystem

Install & Run

Understanding Results

Configuration

Suppression & CI

Limits & Ecosystem

Worth memorizing