Alternatives to Bandit
A command-line static analyser that finds common security issues in Python code. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Bandit
A command-line static analyser that finds common security issues in Python code.
Replacements
Listings that take over the same core job as Bandit.
CodeQL
A semantic code analysis engine from GitHub that lets you query source code to find vulnerabilities.
CodeQL follows data flow across many languages to find vulnerability variants, but free use is limited to research and open source code, and custom queries need the QL language.
SonarQube
A static code analysis platform that flags bugs, maintainability issues and security vulnerabilities.
SonarQube covers many languages and tracks maintainability and reliability alongside security, but it needs a self-hosted server or managed cloud, and advanced features are paid.
Snyk
A hosted developer security platform that scans code and applications for vulnerabilities.
Snyk is a hosted platform that scans code, dependencies and containers, adding dependency checks Bandit lacks, but it needs an account and is aimed mainly at enterprises.
Also worth comparing
These listings name Bandit as their own alternative, so the relationship runs both ways.
Semgrep
Find code patterns and potential problems with static analysis.
Bandit is a free, Apache-licensed static analyser limited to Python code, with ready pre-commit hooks but no custom rule language for other languages.
Similar software
Related functionality, not a direct replacement.
Ruff
Lint and format Python code with one fast command-line tool.
detect-secrets
A command-line tool from Yelp that detects and prevents secrets such as keys being committed to code.
pre-commit
A command-line framework for managing and running multi-language Git pre-commit hooks across projects.
ShellCheck
Catch common shell-script mistakes before running them.
Hadolint
Dockerfile linter that also checks the shell commands inside it.
prek
Run code checks using existing pre-commit hooks and configurations.
