Use current directory unless explicitly specified

[bittner]

Is your feature request related to a problem? Please describe.
A usability issue, not a technical problem. It's also about an alignment of the CLI handling with, e.g., flake8, to honor programmers' muscle memory.

Describe the solution you'd like
Bandit should assume to be meant to run against the current folder, ideally recursively. Hence, running just bandit would try to look up a configuration file (e.g. .bandit et al.) and run its checks against the current working directory in a recursive manner.

Currently, you have to run bandit -r . for the same behavior.

Describe alternatives you've considered
Running Bandit is non-destructive. It should be safe to assume sane defaults to make our lives easier. There are no real alternatives w.r.t. the CLI and the .bandit configuration file.

Just running bandit should do something meaningful (to get the job done, including saving time).

The actual alternative is having a tool that is more cumbersome to use than it could be. We don't want this, do we?

Additional context
See also: #274, #396

[ericwb]

I do agree. And it shouldn't cause any backwards capability issue that I can think of. It would make the -r redundant, but that's okay.

[ericwb]

Rethinking my opinion on this one...

I think we should try to conform to CLI standards as much as possible. After reading (https://clig.dev/#help), it states only if your program is very simple should you automatically run an action. A non-simple command should output the help, as Bandit does today. And I would argue that a Bandit run can be non-trivial and time consuming if run against many files (especially when run recursively). Therefore I feel it's better to keep the current behavior.