Bandit
7.2#4 in sast toolsFree planFree planExtensionLinuxmacOSSelf-hosted
VisitBandit vs gosec
What both publish
| Fact | Bandit | gosec |
|---|---|---|
| Configuration | Configuration files can select or skip tests, change plugin settings, exclude paths, and define profiles. | A JSON configuration file supports global settings such as audit mode and suppression behavior. |
| Documentation depth | The documentation site includes getting started, configuration, integrations, plugin references, formatter references, CI/CD guidance, FAQs, and API modules. | Secure Go publishes per-rule guidance pages and links to API reference, Stack Overflow and Slack support channels. |
| License | The project is distributed under the Apache License 2.0. | The repository states that gosec is licensed under Apache License 2.0. |
| Purpose | Bandit scans Python code to find common security issues by building an AST and running plugins against its nodes. | gosec inspects Go source code for security problems by scanning its AST and SSA code representation. |
| Report formats | Documented formatters include CSV, custom, HTML, JSON, SARIF, screen, text, XML, and YAML. | Output formats include text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint and SARIF. |
| Reports | After scanning files, Bandit generates a report. | Supported output formats include text, JSON, YAML, CSV, JUnit XML, HTML, SonarQube, golint, and SARIF. |
Bandit plans
- BanditFree
- FreeFree
gosec plans
- gosecFree
Pick Bandit if…
Bandit suits Python developers and teams looking for source-code security linting that can be used in editors, pre-commit hooks, or CI workflows. It may also suit teams that want to set aside known findings with a JSON baseline.
Pick gosec if…
gosec is for Go developers and teams who want source-code security checks in local workflows or CI. It also suits teams that need configurable rules and machine-readable reports.