bandit

Security oriented static analyser for python code.

bandit Permissive license Apache-2.0 Active ★ 8,212 v1.9.4 released 2026-02-25

Install

bandit on PyPI

pip

pip install bandit

uv

uv add bandit

poetry

poetry add bandit

Package facts

License	Apache-2.0 (permissive)
Python support	supports the current Python release (>=3.10)
Install friction	low — pure-Python wheel
Runtime dependencies	4 — PyYAML, stevedore, rich, colorama
Maintenance	actively maintained — 169 days since the last release
Last repo commit	2026-08-04
First released	2015-03-23
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: bandit-1.9.4-py3-none-any.whl

Development Status :: 5 - Production/StableEnvironment :: ConsoleIntended Audience :: DevelopersIntended Audience :: Information TechnologyIntended Audience :: System AdministratorsOperating System :: MacOS :: MacOS XOperating System :: POSIX :: LinuxProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: Security

About bandit

from the package's own PyPI description — quoted content, verbatim

.. image:: https://raw.githubusercontent.com/pycqa/bandit/main/logo/logotype-sm.png :alt: Bandit

======

.. image:: https://github.com/PyCQA/bandit/actions/workflows/pythonpackage.yml/badge.svg?branch=main :target: https://github.com/PyCQA/bandit/actions?query=workflow%3A%22Build+and+Test+Bandit%22+branch%3Amain :alt: Build Status

.. image:: https://readthedocs.org/projects/bandit/badge/?version=latest :target: https://readthedocs.org/projects/bandit/ :alt: Docs Status

.. image:: https://img.shields.io/pypi/v/bandit.svg :target: https://pypi.org/project/bandit/ :alt: Latest Version

.. image:: https://img.shields.io/pypi/pyversions/bandit.svg :target: https://pypi.org/project/bandit/ :alt: Python Versions

.. image:: https://img.shields.io/pypi/format/bandit.svg :target: https://pypi.org/project/bandit/ :alt: Format

.. image:: https://img.shields.io/badge/license-Apache%202-blue.svg :target: https://github.com/PyCQA/bandit/blob/main/LICENSE :alt: License

.. image:: https://img.shields.io/discord/825463413634891776.svg :target: https://discord.gg/qYxpadCgkx :alt: Discord

A security linter from PyCQA

Free...

Read as markdown · JSON record · Source repository · Homepage · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Bandit is a security-focused static analyzer that scans Python code for common vulnerabilities by parsing the AST and running security-check plugins against it.

Low friction install with four stable runtime dependencies (PyYAML, stevedore, rich, colorama). Active maintenance with recent release and strong repository engagement indicate solid community backing.

Apache-2.0 permissive license allows commercial and private use with minimal restrictions, making it suitable for most organizational security workflows.

Usage

pip install bandit
python -m bandit -r /path/to/code

Requires Python 3.10 or later; bandit is a CLI tool primarily, not a library for programmatic import.

Verdict: Bandit is a mature, actively maintained security linter with no known vulnerabilities, permissive licensing, and low install friction. It is well-suited for teams seeking automated detection of common Python security issues in CI/CD pipelines or local development workflows.

Needs verification

Whether the tool's plugin ecosystem and coverage of security checks meets your specific threat model.
Performance characteristics on large codebases or whether AST parsing introduces unacceptable latency.

python security linterstatic code analysis securityfind vulnerabilities pythonast-based security scannerpython code security auditdetect insecure patternssecurity static analyzer