flake8-bandit

What it is and what it does

flake8-bandit is a flake8 plugin that runs bandit security checks as part of your normal linting workflow. Instead of running bandit separately, you get security violations reported inline with your other flake8 issues, using 'S' prefixes (e.g., S101) rather than bandit's default 'B' codes to avoid conflicts with flake8-bugbear.

The plugin reads standard .bandit configuration files to let you exclude paths and select specific tests. If you already lint with flake8, adding this plugin means security testing happens automatically without changing your workflow—you just install it and run flake8 as normal.

Use it for:

• Catch common security issues like hardcoded credentials or insecure deserialization during routine code review without a separate bandit run.
• Enforce security standards in CI/CD by failing the flake8 check when security violations are detected.
• Configure which bandit tests to run per project using .bandit files, excluding test directories or third-party code from security scanning.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Integrates bandit security checks into flake8 linting, reporting security issues as flake8 violations with 'S' prefixes instead of the default 'B' codes.

Yes, if you already use flake8 and want security checks integrated into your linting step. The low install friction and permissive license make it a straightforward addition. However, the dormant maintenance status (last release August 2022) means you should verify compatibility with your current flake8 and bandit versions before relying on it in production CI/CD.

Install

flake8-bandit on PyPI

pip install flake8-bandit

uv add flake8-bandit

poetry add flake8-bandit

Installing flake8-bandit

Before you install

Low install friction with only two runtime dependencies (flake8 and bandit). Maintenance is dormant—last release was 2022-08-29 and last commit 2023-09-13—so expect no active bug fixes or feature updates, though the repository remains unarchived.

License in practice

MIT license is permissive, allowing free use, modification, and distribution with minimal restrictions—no legal barrier to adoption.

Quickstart

pip install flake8-bandit

# Then run flake8 as usual; security checks are automatically included
flake8 your_code.py

# Configure via .bandit file:
# [bandit]
# exclude = /tests
# tests: B101

Requires flake8 and bandit to be installed; Python >= 3.6.

Verify before relying

• Whether the package remains compatible with recent flake8 and bandit versions given the dormant maintenance status.
• Whether the 'S' prefix remapping still works correctly with current bandit releases.

Package facts

Evidence: flake8_bandit-4.1.1-py3-none-any.whl

Tags

More Python Modules packages