bandit-sarif-formatter

What it is and what it does

bandit-sarif-formatter is a report formatter plugin for Bandit, Python's security analyzer. It takes Bandit's security findings and outputs them in SARIF (Static Analysis Results Interchange Format) Version 2.1.0, a standardized format maintained by OASIS for security and code-analysis tools. This allows Bandit results to be consumed by CI/CD pipelines, security dashboards, and other tools that understand SARIF.

The package depends on jschema-to-python and sarif-om to handle schema validation and SARIF object modeling. It is invoked as a command-line flag to Bandit and produces a JSON file containing the analysis results in standard format. However, the package has been abandoned since its initial release and may not work reliably with recent versions of Bandit or Python.

Use it for:

• Export Bandit security findings to a standardized format for ingestion into enterprise security dashboards or SIEM systems.
• Integrate Bandit results into CI/CD pipelines that expect SARIF input from multiple static analysis tools.
• Archive security scan results in a vendor-neutral format for compliance reporting and historical analysis.
• Feed Bandit output to third-party tools that parse SARIF to correlate findings across multiple security scanners.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Converts Bandit security analysis output into SARIF 2.1.0 format for integration with tools and workflows that consume standardized security reports.

No. The package is abandoned and has not been updated since 2019-10-05. While it has no known vulnerabilities and low install friction, the lack of maintenance means it will not be compatible with current or future versions of Bandit or Python. Verify first that this formatter works with your current Bandit version before installing.

Install

bandit-sarif-formatter on PyPI

pip install bandit-sarif-formatter

uv add bandit-sarif-formatter

poetry add bandit-sarif-formatter

Installing bandit-sarif-formatter

Before you install

Low install friction with just two runtime dependencies. However, the package is abandoned—last release was 2019-10-05 and the repository was archived. No updates have been made since the initial release, so it will not receive bug fixes or compatibility updates.

License in practice

MIT license permits free use, modification, and distribution with minimal restrictions. You may use this in proprietary projects without sharing source code, though you must retain the license notice.

Quickstart

pip install bandit-sarif-formatter

bandit --format sarif [targets] --output out.sarif

Requires Bandit to be installed separately; the formatter is a plugin that extends Bandit's output capabilities.

Verify before relying

• Whether this formatter remains compatible with current Bandit versions, given the package has not been updated since 2019-10-05.
• Whether jschema-to-python and sarif-om dependencies have received security updates or breaking changes since the formatter's last release.
• Whether Bandit itself now offers native SARIF support, making this formatter redundant.

Package facts

Evidence: bandit_sarif_formatter-1.1.1-py3-none-any.whl

Tags

More Quality Assurance packages

Further reading