Bandit

Bandit is a security-focused linter that scans Python source code for vulnerabilities by analyzing Abstract Syntax Trees (AST).

Bandit scans Python source code for security vulnerabilities by building an Abstract Syntax Tree (AST) and running plugin-based checks. It catches high-risk issues like hardcoded passwords (B105), shell injections (B602), and insecure crypto (B303) before they reach production. Most teams run it recursively (using the -r flag) or integrate it into GitHub Actions for automated security gating. Configuration is handled via bandit.yaml where you can skip specific tests (like B101 for asserts) to keep the signal clear and the noise low.

https://github.com/PyCQA/bandit