PythonSecurityAuditBandit
title: Python Security Audit with Bandit radar_quadrant: Techniques radar_ring: Assess radar_position: center created: 2026-05-22 last_updated: 2026-05-22 related: ["SelfHostedSecurityReview", "DockerSecuritySelfHosting"]
Bandit is a Python static analysis tool that constructs an Abstract Syntax Tree (AST) for each source file and checks for common vulnerability patterns: hardcoded credentials, use of eval, insecure subprocess calls, weak cryptographic primitives, and similar issues.
The primary adoption pattern is adding Bandit as a pre-commit hook via .pre-commit-config.yaml. On commit, Bandit runs against modified files only; pre-commit run --all-files scans the full repository on demand.
A .bandit configuration file excludes directories that should not be scanned (.venv/, tests/) and suppresses checks irrelevant to the project.
Bandit covers static code analysis only — it does not scan dependencies for known CVEs. Dependency vulnerability scanning (pip-audit or safety) is a complementary gap not covered by this workflow.
Python Security Audit with Bandit sits at Techniques → Assess center. Bandit is a well-known tool and the pre-commit integration pattern is straightforward. Center position reflects that the workflow addresses only one layer of Python security (static code analysis) and does not cover the higher-urgency dependency vulnerability gap. The remaining gate before moving inner is pairing Bandit with pip-audit in the same pre-commit configuration to cover both layers.
