From the article: http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/ uncontrolled format strings can provide access to potentially sensitive data. It may be worth creating a Bandit plugin to detect this.