flake8-bandit
Automated security testing with bandit and flake8.
Decision gist · record as of 2026-08-14
Yes, if you already use flake8 and want security checks integrated into your linting step. The low install friction and permissive license make it a straightforward addition. However, the dormant maintenance status (last release August 2022) means you should verify compatibility with your current flake8 and bandit versions before relying on it in production CI/CD.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires flake8 and bandit to be installed; Python >= 3.6.
- Low install friction with only two runtime dependencies (flake8 and bandit).
- Maintenance is dormant—last release was 2022-08-29 and last commit 2023-09-13—so expect no active bug fixes or feature updates, though the repository remains unarchived.
License · maintenance · safety
MIT (permissive) — MIT license is permissive, allowing free use, modification, and distribution with minimal restrictions—no legal barrier to adoption.
last release 2022-08-29 (1446 days) · last repo commit 2023-09-13 · 116 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 532,017 downloads/mo, #6,150 on PyPI
Alternatives
Verify before relying
pip install flake8-bandit
# Then run flake8 as usual; security checks are automatically included
flake8 your_code.py
# Configure via .bandit file:
# [bandit]
# exclude = /tests
# tests: B101- Whether the package remains compatible with recent flake8 and bandit versions given the dormant maintenance status.
- Whether the 'S' prefix remapping still works correctly with current bandit releases.
What it is and what it does
flake8-bandit is a flake8 plugin that runs bandit security checks as part of your normal linting workflow. Instead of running bandit separately, you get security violations reported inline with your other flake8 issues, using 'S' prefixes (e.g., S101) rather than bandit's default 'B' codes to avoid conflicts with flake8-bugbear.
The plugin reads standard .bandit configuration files to let you exclude paths and select specific tests. If you already lint with flake8, adding this plugin means security testing happens automatically without changing your workflow—you just install it and run flake8 as normal.
Use it for
- Catch common security issues like hardcoded credentials or insecure deserialization during routine code review without a separate bandit run.
- Enforce security standards in CI/CD by failing the flake8 check when security violations are detected.
- Configure which bandit tests to run per project using .bandit files, excluding test directories or third-party code from security scanning.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you already use flake8 and want security checks integrated into your linting step.
The low install friction and permissive license make it a straightforward addition. However, the dormant maintenance status (last release August 2022) means you should verify compatibility with your current flake8 and bandit versions before relying on it in production CI/CD.
Install
flake8-bandit on PyPI
Before you install
Low install friction with only two runtime dependencies (flake8 and bandit). Maintenance is dormant—last release was 2022-08-29 and last commit 2023-09-13—so expect no active bug fixes or feature updates, though the repository remains unarchived.
Requires flake8 and bandit to be installed; Python >= 3.6.
License in practice
MIT license is permissive, allowing free use, modification, and distribution with minimal restrictions—no legal barrier to adoption.
Quickstart
pip install flake8-bandit
# Then run flake8 as usual; security checks are automatically included
flake8 your_code.py
# Configure via .bandit file:
# [bandit]
# exclude = /tests
# tests: B101Verify before relying
- Whether the package remains compatible with recent flake8 and bandit versions given the dormant maintenance status.
- Whether the 'S' prefix remapping still works correctly with current bandit releases.
Package facts
| License | MIT permissive |
| Python support | Supports the current Python release >=3.6 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagesflake8bandit |
| Maintenance | Dormant 1,446 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 532,017 / month, #6,150 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Environment :: ConsoleFramework :: Flake8Intended Audience :: DevelopersLicense :: OSI Approved :: MIT LicenseProgramming Language :: PythonProgramming Language :: Python :: 3Topic :: SecurityTopic :: Software Development :: Libraries :: Python ModulesTopic :: Software Development :: Quality Assurance |
Evidence: flake8_bandit-4.1.1-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “flake8 security plugin”
- flake8-banditIntegrates bandit security checks into flake8 linting, reporting…
- dlintDlint is a flake8 plugin that adds security-focused and best-practice…
- flake8-plugin-utilsProvides base classes and utilities for writing flake8 plugins,…
Give your agent the search over MCP, or paste the wish link into any chat.
More Python Modules packages
Converts domain names between Unicode and ASCII-compatible encoding (Punycode) according to IDNA 2008 and Unicode Technical Standard 46, with security validation and broader script coverage than the standard library.
Install it if you work with internationalized domain names, need to validate domains, or use HTTP clients that depend on it transitively.
Setuptools is a Python build backend and package management tool that handles building, distributing, and installing Python packages, including support for C/C++ extension modules.
PyYAML parses and emits YAML 1.1 data format, enabling serialization and deserialization of configuration files and Python objects to and from human-readable YAML text.
Pydantic validates Python data structures against type hints, coercing and checking input at runtime to ensure it matches a declared schema.
Provides reusable metadata objects for use with PEP-593 `typing.Annotated` to express common constraints like bounds, collection sizes, and predicates on types.
Install it if you use or build libraries that need to express type constraints in a standardized, inspectable way—or if you want to annotate your own types with…
Provides runtime tools to inspect and introspect Python type annotations, enabling programmatic examination of type hints at execution time.
See also bandit · flake8-bugbear · flake8 · dlint · flake8-pyi · flake8-html · wemake-python-styleguide · flake8-black · flake8-import-order · bandit-sarif-formatter