Bandit
A command-line static analyser that finds common security issues in Python code.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get Bandit
Package managers
- Homebrew
brew install bandit
About Bandit
Bandit scans Python source code for common security problems and reports what it finds in the terminal. It is aimed at developers who want to catch risky patterns before code is merged or shipped.
It can run as a pre-commit hook, and the project includes a Docker setup, so it fits into local workflows and continuous integration. It is maintained under the Python Code Quality Authority alongside other Python linting tools.
Strengths
- Focused on security issues in Python code
- Ready-made pre-commit hooks
- Runs locally with no account
- Maintained by PyCQA
Limitations
- Python code only
- Pattern-based checks can produce false positives
- Does not check third-party dependencies for known vulnerabilities
Details
- Pricing
- FreeFree and open source.
- License
- Apache-2.0
- Developer
- PyCQA
- Platforms
- Windows, macOS, Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Python developers adding security checks to their workflow
- Categories
- CLI tools, Security tools, Developer tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to Bandit
Compare allSoftware that can replace Bandit for an important use case, and what changes if you switch.
CodeQL
A semantic code analysis engine from GitHub that lets you query source code to find vulnerabilities.
CodeQL follows data flow across many languages to find vulnerability variants, but free use is limited to research and open source code, and custom queries need the QL language.
SonarQube
A static code analysis platform that flags bugs, maintainability issues and security vulnerabilities.
SonarQube covers many languages and tracks maintainability and reliability alongside security, but it needs a self-hosted server or managed cloud, and advanced features are paid.
Snyk
A hosted developer security platform that scans code and applications for vulnerabilities.
Snyk is a hosted platform that scans code, dependencies and containers, adding dependency checks Bandit lacks, but it needs an account and is aimed mainly at enterprises.
Bandit as an alternative
Listings that name Bandit as an alternative.
Semgrep
Find code patterns and potential problems with static analysis.
Bandit is a free, Apache-licensed static analyser limited to Python code, with ready pre-commit hooks but no custom rule language for other languages.
Similar software
Related functionality, not necessarily a direct replacement.
Ruff
Lint and format Python code with one fast command-line tool.
detect-secrets
A command-line tool from Yelp that detects and prevents secrets such as keys being committed to code.
pre-commit
A command-line framework for managing and running multi-language Git pre-commit hooks across projects.
ShellCheck
Catch common shell-script mistakes before running them.
Hadolint
Dockerfile linter that also checks the shell commands inside it.
prek
Run code checks using existing pre-commit hooks and configurations.
