Bandit review
A free, focused Python scanner with configurable checks and CI workflows.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Bandit is an open-source command-line security linter from PyCQA that scans Python source files for common security issues. It parses files into abstract syntax trees and runs security test plugins against them. Python teams that want a free, focused scanner for local use, pre-commit checks, or CI workflows are its clearest fit. Its Python-only scope makes it a poor match for teams seeking one scanner across a heterogeneous codebase.
The scanning workflow offers several ways to tune results: teams can filter by severity and confidence, configure test profiles in YAML, TOML, or INI, include or skip selected tests, and suppress individual findings with inline # nosec comments. Baseline report comparison can help distinguish new findings from existing ones. Reports can be generated in JSON or SARIF, and the tool supports recursive and standard-input scans. This flexibility suits teams that want control over focused Python checks; it still centers on security analysis rather than type checking or general bug detection.
Bandit is self-hosted and open source, not a hosted service. It can be installed with pip, run as a pre-commit hook, or included in CI/CD workflows such as GitHub Actions. Documentation and community are the listed support channels. That makes it a practical choice for teams comfortable maintaining a local tool and integrating it into their own process. Choose another option if you need multi-language coverage, a hosted scanning service, or support beyond documentation and community.
Bandit pros and cons
- Where it wins
- Scans Python ASTs with security test and blacklist plugins
- Filters by severity and confidence, with baseline comparison
- Supports GitHub Actions and pre-commit workflows
- Where it doesn't
- Limited to Python source files
- Runs locally rather than as a hosted service
- Support is through documentation and community
Bandit fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update