Security oriented static analyser for python code.

Navigation

Verified details

These details have been verified by PyPI
Project links
Owner
GitHub Statistics
Maintainers
Avatar for chair6 from gravatar.com chair6 Avatar for ericwb from gravatar.com ericwb Avatar for tkelsey from gravatar.com tkelsey

Unverified details

These details have not been verified by PyPI
Project links
Meta
  • License: Apache-2.0
  • Author: PyCQA
  • Requires: Python >=3.10
  • Provides-Extra: yaml , toml , baseline , sarif , test
Classifiers
Report project as malware

Project description

Bandit
Build Status Docs Status Latest Version Python Versions Format License Discord

A security linter from PyCQA

Overview

Bandit is a tool designed to find common security issues in Python code. To do this Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. Once Bandit has finished scanning all the files it generates a report.

Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA.

Bandit Example Screen Shot

Show Your Style

Security Status

Use our badge in your project’s README!

using Markdown:

[![security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)

using RST:

.. image:: https://img.shields.io/badge/security-bandit-yellow.svg
    :target: https://github.com/PyCQA/bandit
    :alt: Security Status

References

Python AST module documentation: https://docs.python.org/3/library/ast.html

Green Tree Snakes - the missing Python AST docs: https://greentreesnakes.readthedocs.org/en/latest/

Documentation of the various types of AST nodes that Bandit currently covers or could be extended to cover: https://greentreesnakes.readthedocs.org/en/latest/nodes.html

Container Images

Bandit is available as a container image, built within the bandit repository using GitHub Actions. The image is available on ghcr.io:

docker pull ghcr.io/pycqa/bandit/bandit

The image is built for the following architectures:

  • amd64

  • arm64

  • armv7

  • armv8

To pull a specific architecture, use the following format:

docker pull --platform=<architecture> ghcr.io/pycqa/bandit/bandit:latest

Every image is signed with sigstore cosign and it is possible to verify the source of origin using the following cosign command:

cosign verify ghcr.io/pycqa/bandit/bandit:latest \
  --certificate-identity https://github.com/pycqa/bandit/.github/workflows/build-publish-image.yml@refs/tags/<version> \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Where <version> is the release version of Bandit.

Sponsors

The development of Bandit is made possible by the following sponsors:

Mercedes-Benz Tidelift Stacklok

If you also ❤️ Bandit, please consider sponsoring.

Project details

Verified details

These details have been verified by PyPI
Project links
Owner
GitHub Statistics
Maintainers
Avatar for chair6 from gravatar.com chair6 Avatar for ericwb from gravatar.com ericwb Avatar for tkelsey from gravatar.com tkelsey

Unverified details

These details have not been verified by PyPI
Project links
Meta
  • License: Apache-2.0
  • Author: PyCQA
  • Requires: Python >=3.10
  • Provides-Extra: yaml , toml , baseline , sarif , test
Classifiers

Release history Release notifications | RSS feed

This version

1.9.3

1.9.2

1.9.1

1.8.6

1.8.5

1.8.3

1.8.2

1.8.1

1.8.0

1.7.10

1.7.9

1.7.8

1.7.7

1.7.6

1.7.5

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

1.6.3 yanked

Reason this release was yanked:

This version dropped py2 but was still published as a universal wheel, thus causing issues install via py2 pip.

1.6.2

1.6.1

1.6.0

1.5.1

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.1

0.17.3

0.17.2

0.17.0

0.16.2

0.16.1

0.16.0

0.15.2

0.15.1

0.15.0

0.14.1

0.14.0

0.13.2

0.13.1

0.13.0

0.12.0

0.11.0

0.10.1

0.10.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

bandit-1.9.3.tar.gz (4.2 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

bandit-1.9.3-py3-none-any.whl (134.5 kB view details)

Uploaded Python 3

File details

Details for the file bandit-1.9.3.tar.gz.

File metadata

  • Download URL: bandit-1.9.3.tar.gz
  • Upload date:
  • Size: 4.2 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for bandit-1.9.3.tar.gz
Algorithm Hash digest
SHA256 ade4b9b7786f89ef6fc7344a52b34558caec5da74cb90373aed01de88472f774
MD5 61976515b1e56ed21a4950b217294a49
BLAKE2b-256 8976a7f3e639b78601118aaa4a394db2c66ae2597fbd8c39644c32874ed11e0c

See more details on using hashes here.

Provenance

The following attestation bundles were made for bandit-1.9.3.tar.gz:

Publisher: publish-to-pypi.yml on PyCQA/bandit

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file bandit-1.9.3-py3-none-any.whl.

File metadata

  • Download URL: bandit-1.9.3-py3-none-any.whl
  • Upload date:
  • Size: 134.5 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for bandit-1.9.3-py3-none-any.whl
Algorithm Hash digest
SHA256 4745917c88d2246def79748bde5e08b9d5e9b92f877863d43fab70cd8814ce6a
MD5 7af6a5b719edc9724cda7e9288667518
BLAKE2b-256 e00b8bdc52111c83e2dc2f97403dc87c0830b8989d9ae45732b34b686326fb2c

See more details on using hashes here.

Provenance

The following attestation bundles were made for bandit-1.9.3-py3-none-any.whl:

Publisher: publish-to-pypi.yml on PyCQA/bandit

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page