---
id: flake8-bandit
version: "4.1.1"
license: MIT
license_treatment: permissive
maintenance: dormant
---

# flake8-bandit — Automated security testing with bandit and flake8.

License: permissive · Maintenance: dormant · Downloads: 532.0K/mo

## What it is and what it does

flake8-bandit is a flake8 plugin that runs bandit security checks as part of your normal linting workflow. Instead of running bandit separately, you get security violations reported inline with your other flake8 issues, using 'S' prefixes (e.g., S101) rather than bandit's default 'B' codes to avoid conflicts with flake8-bugbear.

The plugin reads standard .bandit configuration files to let you exclude paths and select specific tests. If you already lint with flake8, adding this plugin means security testing happens automatically without changing your workflow—you just install it and run flake8 as normal.

Use it for:

- Catch common security issues like hardcoded credentials or insecure deserialization during routine code review without a separate bandit run.
- Enforce security standards in CI/CD by failing the flake8 check when security violations are detected.
- Configure which bandit tests to run per project using .bandit files, excluding test directories or third-party code from security scanning.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Integrates bandit security checks into flake8 linting, reporting security issues as flake8 violations with 'S' prefixes instead of the default 'B' codes.

Yes, if you already use flake8 and want security checks integrated into your linting step. The low install friction and permissive license make it a straightforward addition. However, the dormant maintenance status (last release August 2022) means you should verify compatibility with your current flake8 and bandit versions before relying on it in production CI/CD.

## Install

pip install flake8-bandit
uv add flake8-bandit
poetry add flake8-bandit

## Installing flake8-bandit

Before you install: Low install friction with only two runtime dependencies (flake8 and bandit). Maintenance is dormant—last release was 2022-08-29 and last commit 2023-09-13—so expect no active bug fixes or feature updates, though the repository remains unarchived.

License in practice: MIT license is permissive, allowing free use, modification, and distribution with minimal restrictions—no legal barrier to adoption.

Quickstart:

pip install flake8-bandit

# Then run flake8 as usual; security checks are automatically included
flake8 your_code.py

# Configure via .bandit file:
# [bandit]
# exclude = /tests
# tests: B101

Requires flake8 and bandit to be installed; Python >= 3.6.

Verify before relying:

- Whether the package remains compatible with recent flake8 and bandit versions given the dormant maintenance status.
- Whether the 'S' prefix remapping still works correctly with current bandit releases.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: dormant
- Downloads: 532.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

flake8 security plugin, bandit integration flake8, automated security linting, python code security checks, security violations in flake8, security-linting, flake8-plugin

[View on SkillFed](https://skillfed.io/packages/flake8-bandit) · [View on PyPI](https://pypi.org/project/flake8-bandit/)