Bandit

Bandit is a static analysis tool designed to find common security issues in Python code. It processes each file, builds an abstract syntax tree (AST) from it and runs plugins against the AST nodes; once all files have been scanned, it generates a report.

Bandit can be run from the command line, configured to select or skip tests, and integrated into continuous integration and deployment pipelines.

Bandit is maintained by the Python Code Quality Authority (PyCQA) on GitHub and distributed under the Apache License 2.0; version 1.9.4 was released in February 2026.