Bandit

Bandit is a free security linter for Python source code. It builds an abstract syntax tree from files and runs plugins against the tree’s nodes to identify common security issues, then generates a report. A JSON baseline can be used to set aside known findings considered non-issues. Bandit is distributed through PyPI, and its documentation recommends installation with pip. Optional installation extras provide TOML support, the bandit-baseline command-line tool, and SARIF output formatting. Teams can configure it as a pre-commit hook or use documented integrations with editors and development tools, including Visual Studio Code, Sublime Text, Vim/Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. The project also publishes a container image for amd64, arm64, armv7, and armv8 architectures. It says those images are signed with Sigstore Cosign and provides a way to verify their origin. Bandit’s library is under the Apache License 2.0. For support, the documentation links to a GitHub issue tracker and a Discord community; vulnerability reports are directed through GitHub’s private vulnerability reporting, with an additional request to notify Tidelift security.

Bandit offers Python security scanning with reports, baseline handling, and integrations for editors and CI workflows. Teams can also use its published containers, while keeping in mind its stated focus on Python code.

Bandit may suit Python developers and teams seeking a source-code security linter that can run in pre-commit workflows, editors, and CI tools. The baseline option may help teams distinguish known findings they consider non-issues.

Overview

Bandit is a free static security scanner for Python source code. It is best suited to Python developers and teams that want checks in their existing editor or build workflow. Its appeal is a focused, no-cost scanner; its boundary is equally clear: it is built for Python, not broad, multi-language application security.

Key features

Bandit builds an abstract syntax tree from source files and runs plugins against the resulting nodes, then generates a scan report. That makes it a targeted way to look for common security issues in Python code, rather than a general-purpose review of an entire application.

Teams can add custom security rules to fit their own checks. A JSON baseline can suppress known findings considered non-issues, which can help make scans more manageable in an established codebase. It handles accepted findings; it does not widen the scanner's language coverage.

Bandit is distributed through PyPI, and its documentation recommends installing it with pip. Optional installation extras add TOML support, the bandit-baseline command-line interface, and SARIF output formatting. These are useful workflow and output options, while remaining add-ons to the same Python-focused scanner.

Integrations cover Visual Studio Code, Sublime Text, Vim and Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. Repository pre-commit hooks offer another point to run checks, before code advances through review or CI. This range makes Bandit more practical for teams that want scanning within familiar tools, though it still depends on those workflows rather than providing a separate managed security service.

For container-based use, the project publishes images on ghcr.io for amd64, arm64, armv7, and armv8. The project says each image is signed with Sigstore Cosign and provides a command to verify source of origin. Its security policy directs vulnerability reports through GitHub's private vulnerability reporting and asks reporters to notify Tidelift security as well. Documentation points users to the GitHub issue tracker and Bandit Discord community for support.

Pricing

Bandit costs free as free software under the Apache License 2.0. There is no paid tier to unlock its scanning workflow, and the free plan has no stated seat or scan quota. That makes it a straightforward fit for individuals and teams comfortable running an open-source tool; those seeking a paid, managed service should look elsewhere.

Platforms

Bandit is available for Linux and macOS, and supports self-hosted use. Its editor integrations provide IDE support, while GitHub Actions and Jenkins integrations support CI/CD workflows. The published container architectures offer another deployment option for teams using compatible environments.

Who it's for

Choose Bandit if your codebase is Python and you want a focused security linter that can sit in an editor, pre-commit hook, or CI process without a software fee. Its custom rules and baseline are useful when teams need to tailor checks or manage known findings. It is not the right primary choice for teams that need scanning across multiple languages or a wider application-security platform.

Pros and cons

• Pros: Free under Apache License 2.0, with no paid tier needed for its core Python-scanning use.
• Pros: Baselines, custom rules, and editor, pre-commit, and CI integrations give teams ways to fit checks into existing development workflows.
• Pros: Published container images span four architectures, with Cosign signing and an origin-verification command.
• Cons: Its stated focus is Python source code, so teams with mixed-language portfolios will need additional coverage.
• Cons: The project centers on a linter and its reports; teams looking for a broader managed security platform should consider alternatives.

Alternatives

Semgrep Code is worth considering when a team needs a broader platform choice: its free edition includes Code and Supply Chain, up to 10 repositories, a maximum of 10 contributors, and 60 AI credits. Bandit is the simpler fit when Python-focused scanning and a free open-source license are the priority.

Snyk Open Source is a better fit for teams prioritizing software composition analysis: its free plan covers five projects and access to Snyk Open Source (SCA), while Bandit focuses on Python source-code security scanning.

Brakeman is a Ruby on Rails vulnerability scanner, and Flawfinder is a free option for teams seeking a tool usable on Linux, macOS, or Windows.

gosec is a free, Apache License 2.0 security checker for Go, while MobSF is a free open-source framework with broader platform availability, including web and Windows.

NaiveSystems Analyze offers a free plan for individuals and small teams, with some open-source components including an on-premises analysis runner. NodeJsScan is a free, open-source, self-hosted alternative for Node.js, available through Docker or local setup.

For more options, see SAST Tools and Static Application Security Testing Software.

Verdict

Bandit is an easy recommendation for Python developers who want a free security scan integrated into the tools and automation they already use. Its baseline and custom-rule support help make it adaptable within that focused role. Look elsewhere if you need one scanner for several languages or a broader security platform.