Bandit
7.2#4 in sast toolsFree planFree planExtensionLinuxmacOSSelf-hosted
VisitBandit vs OpenGrep
OpenGrep
7.3#3 in static application security testing softwareFree planFree planAPILinuxmacOSSelf-hosted
VisitWhat both publish
| Fact | Bandit | OpenGrep |
|---|---|---|
| Installation | The documented primary installation method is pip, with optional extras for TOML, baseline, and SARIF support. | The official installer supports Linux and macOS through install.sh and Windows through PowerShell install.ps1. |
| Integrations | Official integration documentation lists VS Code, Sublime Text, Vim/Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. | The repository documents a CI subcommand, and its output formats include JSON and SARIF. |
| License | The project is distributed under the Apache License 2.0. | The repository identifies OpenGrep as a fork of Semgrep under the LGPL 2.1 license. |
| Purpose | Bandit scans Python code to find common security issues by building an AST and running plugins against its nodes. | OpenGrep is an open-source static code analysis engine for finding security issues and searching code patterns. |
Bandit plans
- BanditFree
- FreeFree
OpenGrep plans
- OpenGrepFree
Pick Bandit if…
Bandit suits Python developers and teams looking for source-code security linting that can be used in editors, pre-commit hooks, or CI workflows. It may also suit teams that want to set aside known findings with a JSON baseline.
Pick OpenGrep if…
OpenGrep suits developers and organizations looking for a free static analysis engine they can run in their own environment. Existing Semgrep rule users can apply those rules without changes.