Bandit
7.2#4 in sast toolsFree planFree planExtensionLinuxmacOSSelf-hosted
VisitBandit vs Semgrep Code
Semgrep Code
8.3#1 in sast toolsFrom $15 a monthFree planWebAPIExtensionLinux
VisitWhat both publish
| Fact | Bandit | Semgrep Code |
|---|---|---|
| Documentation depth | The documentation site includes getting started, configuration, integrations, plugin references, formatter references, CI/CD guidance, FAQs, and API modules. | Documentation covers scanning, rule writing, CLI commands, APIs, integrations, billing, support and release notes, with community Slack and GitHub issue support. |
| Installation | The documented primary installation method is pip, with optional extras for TOML, baseline, and SARIF support. | Official installation paths include Homebrew on macOS, pip on Windows and Linux, and a semgrep/semgrep Docker image on Linux. |
| Integrations | Official integration documentation lists VS Code, Sublime Text, Vim/Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. | Supported workflow connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, Buildkite, HackerOne, Slack, email, webhooks, VS Code and IntelliJ. |
| Purpose | Bandit scans Python code to find common security issues by building an AST and running plugins against its nodes. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
Bandit plans
- BanditFree
- FreeFree
Semgrep Code plans
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
Pick Bandit if…
Bandit suits Python developers and teams looking for source-code security linting that can be used in editors, pre-commit hooks, or CI workflows. It may also suit teams that want to set aside known findings with a JSON baseline.
Pick Semgrep Code if…
Semgrep Code suits development teams looking for source-code vulnerability scanning within pull request, IDE or CI workflows. The listed Free Edition is for teams within its repository and contributor limits; larger teams can consider the paid tiers.