Bandit
Bandit is a free security linter for Python source code.
What Bandit is
Bandit is a free security linter for Python source code. It builds an abstract syntax tree from scanned files and runs plugins against the tree's nodes to identify common security issues, then generates a report. A JSON baseline can be used to set aside known findings considered non-issues. Bandit is distributed through PyPI, and its documentation recommends installation with pip. Optional installation extras provide TOML support, the bandit-baseline command-line tool, and SARIF output formatting. It can be configured as a pre-commit hook. Listed integrations include Visual Studio Code, Sublime Text, Vim and Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. The project also publishes container images for amd64, arm64, armv7, and armv8 architectures, and says they are signed with Sigstore Cosign with a way to verify their source of origin. Bandit runs on Linux and macOS and can be used in self-hosted environments. Its library is licensed under Apache License 2.0; support links include a GitHub issue tracker and Discord community.
Good
- Free software under Apache License 2.0.
- Supports pre-commit hooks and CI integrations.
- Optional SARIF output formatting is available.
- JSON baselines can set aside known findings.
Watch out
- Targets Python code only.
- Documented platform support lists Linux and macOS.
- Optional features require installation extras.
Who it suits
Bandit suits Python developers and teams looking for source-code security linting that can be used in editors, pre-commit hooks, or CI workflows. It may also suit teams that want to set aside known findings with a JSON baseline.
Verdict
Bandit focuses on identifying common security issues in Python code and fits into several documented development workflows. Its baseline and integration options can help teams incorporate its reports into existing practices.
Plans and prices
From Bandit's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Bandit | Free | Free software · Apache License 2.0 |
| Free | Free | open-source Python security linter · self-hosted CLI/container use · Free software |
The facts
Each one read from Bandit's own pages, with the date it was checked.
What it does
- Baseline
- A JSON baseline report can be used to ignore known findings considered non-issues.checked 5 Oct 2026
- Baselines
- Bandit can compare a scan with a JSON baseline report to suppress known findings.checked 21 Oct 2026
- Community listing rating
- HelloGitHub shows 0 ratings for the PyCQA/bandit repository.checked 21 Oct 2026
- Configuration
- Configuration files can select or skip tests, change plugin settings, exclude paths, and define profiles.checked 21 Oct 2026
- Container
- Official container images are published on ghcr.io for amd64, arm64, armv7, and armv8.checked 21 Oct 2026
- Documentation depth
- The documentation site includes getting started, configuration, integrations, plugin references, formatter references, CI/CD guidance, FAQs, and API modules.checked 21 Oct 2026
- Formatter extensibility
- Report formatters are themselves plugins and additional formatter entry points can be registered through setuptools or pbr.checked 21 Oct 2026
- GitHub Action
- The official GitHub Action supports Python version, profile, tests, skips, severity, confidence, exclusions, baseline, ini, and target inputs.checked 21 Oct 2026
- Image verification
- The project says every container image is signed with Sigstore Cosign and provides a command to verify its source of origin.checked 5 Oct 2026
- Installation
- The documented primary installation method is pip, with optional extras for TOML, baseline, and SARIF support.checked 21 Oct 2026
- Integrations
- Official integration documentation lists VS Code, Sublime Text, Vim/Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8.checked 21 Oct 2026
- Intended use
- The project describes Bandit as a security linter for Python code.checked 5 Oct 2026
- License
- The project is distributed under the Apache License 2.0.checked 21 Oct 2026
- Limit: Python-only scope
- Independent reviews identify the Python-only, source-pattern focus as a limitation for polyglot repositories.checked 21 Oct 2026
- Limit: shallow analysis
- Independent guidance says Bandit cannot follow dynamic behavior or provide deep interprocedural dataflow analysis.checked 21 Oct 2026
- Operating systems
- PyPI classifies the package for macOS and POSIX/Linux environments.checked 21 Oct 2026
- Plugin extensibility
- Third-party test plugins are registered through bandit.plugins entry points and receive a context object and AST node.checked 21 Oct 2026
- Praise: CI output
- GitNux highlights CI-friendly output formats that can feed automated reporting and dashboards.checked 21 Oct 2026
- Praise: configurable rules
- GitNux praises the plugin-based engine, configurable filtering, and ability to add or tailor checks.checked 21 Oct 2026
- Pre-commit
- The project documents a pre-commit hook configuration using the PyCQA/bandit repository.checked 21 Oct 2026
- Project origin
- Bandit began in the OpenStack Security Project and was later moved to PyCQA.checked 21 Oct 2026
- Purpose
- Bandit scans Python code to find common security issues by building an AST and running plugins against its nodes.checked 5 Oct 2026
Where it runs
- Limit: no platform governance
- Independent guidance describes Bandit as a local CLI without centralized dashboards, policy management, or cross-project reporting.checked 21 Oct 2026
The company
- Maker structure
- PyCQA expands to Python Code Quality Authority and is described by its own documentation as a loose organization of project maintainers.checked 21 Oct 2026
Alternatives to Bandit
- 1
Semgrep Code
Free planOpen sourceWebAPIExtensionLinux8.3From $15 a month - 2
MobSF
Free planOpen sourceWebAPILinuxmacOS8.2From $2,999.99 a year - 3
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 4
gosec
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 5
NaiveSystems Analyze
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.2Free plan - 6
Kiuwan Code Security
WebAPILinuxmacOS6.8From $49 a month