Bandit

Bandit is a static analysis tool that scans Python code for common security issues and produces reports that include severity and confidence levels. It analyzes each file by building an abstract syntax tree (AST) and running a set of security-focused plugins against it.

Installation and Setup

Install it from PyPI:

Windows PowerShell 
PS> py -m pip install bandit
Shell 
$ python3 -m pip install bandit

Optionally configure Bandit in a bandit.yaml or pyproject.toml file (passed with -c) to set exclude directories, select or skip specific tests, and override per-plugin settings. Bandit also picks up a project-level .bandit INI file automatically when you run it with -r. TOML configuration needs an optional extra, so install bandit[toml] if you want to keep your settings in pyproject.toml. SARIF output also needs an optional extra, so install bandit[sarif] if you want to feed results into a code-scanning pipeline.

Key Features

  • Runs AST-based static analysis with a plugin system that targets common Python security pitfalls.
  • Provides tunable severities and confidences through command-line flags or configuration.
  • Generates multiple output formats including text, JSON, HTML, CSV, XML, YAML, and SARIF for code-scanning integrations.
  • Provides baseline support that filters out known findings to focus reviews on newly introduced issues.
  • Runs recursive project scans with directory excludes and targeted file selection.

Usage

Scan a project directory recursively and show results:

Shell 
$ bandit -r src/

Exclude paths like tests/ or generated artifacts:

Shell 
$ bandit -r . -x tests,build,dist

Skip specific checks by ID and list only the issues you care about:

Shell 
$ bandit -r src/ -s B101,B404

Generate JSON and HTML reports:

Shell 
$ bandit -r src/ -f json -o bandit.json
$ bandit -r src/ -f html -o bandit.html
Python Code Quality Illustration

Tutorial

Python Code Quality: Best Practices and Tools

In this tutorial, you'll learn about code quality and the key factors that make Python code high-quality. You'll explore effective strategies, powerful tools, and best practices to elevate your code to the next level.

intermediate best-practices python tools

For additional information on related topics, take a look at the following resources:

By Leodanis Pozo Ramos • Updated Sept. 4, 2026
Python Tools Share Feedback