Bandit
Bandit: A free, focused Python scanner with configurable checks and CI workflows. Ranked #12 of 25 in Static Application Security Testing Sast by our editors (8.0/10); pricing: Free plan; best for python teams wanting a free focused scanner.
At a glance
- Editor score8.0 / 10
- PricingFree plan
- Best forPython teams wanting a free focused scanner
- Free planYes
- Paid fromFree
- Facts checked24 Sep 2026
Where it wins
- Scans Python ASTs with security test and blacklist plugins
- Filters by severity and confidence, with baseline comparison
- Supports GitHub Actions and pre-commit workflows
Where it doesn't
- Limited to Python source files
- Runs locally rather than as a hosted service
- Support is through documentation and community
Our verdict on Bandit
Bandit is an open-source command-line security linter from PyCQA that scans Python source files for common security issues. It parses files into abstract syntax trees and runs security test plugins against them. Python teams that want a free, focused scanner for local use, pre-commit checks, or CI workflows are its clearest fit. Its Python-only scope makes it a poor match for teams seeking one scanner across a heterogeneous codebase.
The scanning workflow offers several ways to tune results: teams can filter by severity and confidence, configure test profiles in YAML, TOML, or INI, include or skip selected tests, and suppress individual findings with inline # nosec comments. Baseline report comparison can help distinguish new findings from existing ones. Reports can be generated in JSON or SARIF, and the tool supports recursive and standard-input scans. This flexibility suits teams that want control over focused Python checks; it still centers on security analysis rather than type checking or general bug detection.
Bandit is self-hosted and open source, not a hosted service. It can be installed with pip, run as a pre-commit hook, or included in CI/CD workflows such as GitHub Actions. Documentation and community are the listed support channels. That makes it a practical choice for teams comfortable maintaining a local tool and integrating it into their own process. Choose another option if you need multi-language coverage, a hosted scanning service, or support beyond documentation and community.
Your product? Our editors can test Bandit in depth and publish a review, labelled as paid · from $149/mo →
Bandit pricing
Bandit fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Languages supported | Not verified |
| IDE integration | Not verified |
| CI/CD integration | Yes |
| Deployment | Not verified |
| Custom rules | Yes |
| Pull request scanning | Not verified |
| Deployment | Self-hosted |
| Support | Docs, Community |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 2 integrations: GitHub Actions, pre-commit |
| Pricing | Free plan |
| Website | bandit.readthedocs.io |
| Facts checked | 24 Sep 2026 |
Bandit integrations
Bandit lists 2 integrations on its own site.
- GitHub Actions
- pre-commit
Alternatives to Bandit
- Checkmarx SASTBroad source analysis with custom queries and remediation guidance for enterprise teams.9.3
- Snyk CodeSource-code scanning across IDEs, pull requests and CI/CD, with a free entry tier.9.1
- OpenText Fortify SASTBroad SAST coverage with pull-request scans, custom rules, and AI-assisted fixes.8.9
Used Bandit? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Bandit for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Bandit is listed in our Static Application Security Testing Sast directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/bandit-sast-tool/"><img src="https://www.itechguides.com/best/badge/bandit-sast-tool.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update