PyCQA/bandit

View on GitHub

Bandit is a tool designed to find common security issues in Python code.

Stars: 8.3k
Forks: 835
Open beginner issues: 0
Indexed issues: 193
Avg merge: 5d 3h
Merged PRs (30d): 1

Dominant language: Python
License: Apache-2.0
Last GitHub push: Aug 29, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

193 open issues indexed

Test issue Open

Difficulty 5/5 Over a week Newbie friendliness 1/100

PyCQA/bandit#1468 · Opened Aug 15, 2026
Baseline matching ignores line number and uses set membership, not count Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 75/100

PyCQA/bandit#1467 · 1 comment · Opened Aug 15, 2026
B501 and B113 skip requests.request(), while httpx.request() is checked Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

PyCQA/bandit#1465 · 1 comment · Opened Jul 30, 2026
Troubles with conflicting cryptography and cffi Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 42/100

PyCQA/bandit#1461 · 3 comments · Opened Jul 21, 2026
Feature request: Adding Canary Credentials to detect supply chain compromise Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

PyCQA/bandit#1432 · Opened Jun 1, 2026
`bandit -ii -ll -ii -ll` raises an `IndexError` Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

PyCQA/bandit#1423 · 1 comment · Opened May 22, 2026
B704 false negative for local Markup subclasses (CVE-2025-54384) Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

PyCQA/bandit#1405 · 2 comments · Opened Apr 28, 2026
B701: Extend Jinja2 checks to cover dynamic template source execution Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 56/100

PyCQA/bandit#1404 · 3 comments · 3 reactions · Opened Apr 28, 2026
Proposal: Detecting Flask file-serving API misuse Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 67/100

PyCQA/bandit#1403 · 1 comment · 3 reactions · Opened Apr 28, 2026
Feature request (with my own implementation): add a plugin which detects common SSRF cases where user-controlled URLs flow into outbound HTTP requests Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

PyCQA/bandit#1401 · 2 reactions · Opened Apr 27, 2026
Methods to Bypass Bandit Detection Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

PyCQA/bandit#1399 · 2 comments · Opened Apr 20, 2026
False negative: narrow argument-shape checks in B508/B509 Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

PyCQA/bandit#1397 · 2 comments · Opened Apr 19, 2026
False negative: B104 misses `bind(("", port))` wildcard host Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

PyCQA/bandit#1395 · 1 comment · Opened Apr 19, 2026
False negative: B501 misses `verify=False` on `requests.Session` / `httpx.Client` instance methods Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

PyCQA/bandit#1394 · Opened Apr 17, 2026
False negative: B202 unsafe `tarfile.extract()` not detected Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

PyCQA/bandit#1392 · Opened Apr 17, 2026
False negative: B103 fails to detect dangerous permissions set via stat module constants Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

PyCQA/bandit#1390 · Opened Apr 15, 2026
False Negatives in B105/B106/B107 Hardcoded Password Detection Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 62/100

PyCQA/bandit#1383 · 1 comment · Opened Apr 7, 2026
Follow-up on GHSA-ggq6-wv5j-cpfg Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

PyCQA/bandit#1381 · Opened Apr 1, 2026
Unclear FAQ entry regarding "Under Which Version of Python Should I Install Bandit?" Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

PyCQA/bandit#1375 · Opened Mar 23, 2026
[Security] tarfile.extractall without member validation in examples/tarfile_extractall.py Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

PyCQA/bandit#1373 · 1 comment · Opened Mar 16, 2026
Flag logging/printing of likely sensitive information Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

PyCQA/bandit#1371 · Opened Mar 15, 2026
Suppressing B105 on a multiline dict assignment Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 42/100

PyCQA/bandit#1352 · 1 comment · Opened Jan 24, 2026
using `xml.etree.ElementTree.fromstring` shouldn't raise errors in python versions 3.11 and up Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

PyCQA/bandit#1344 · Opened Dec 15, 2025
Add check for decompression bomb vulnerabilities Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 52/100

PyCQA/bandit#1339 · 1 comment · Opened Nov 29, 2025
Should exit with non-zero code when scanning fails Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

PyCQA/bandit#1326 · 1 reaction · Opened Nov 13, 2025
Add support for per-file rule ignores in configuration Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

PyCQA/bandit#1322 · 1 comment · 4 reactions · Opened Oct 31, 2025
Add Installation Guidelines in README.md Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 55/100

PyCQA/bandit#1320 · 4 comments · Opened Oct 27, 2025
Sarif formatter physicalLocation calculation error Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 72/100

PyCQA/bandit#1311 · 1 comment · 1 reaction · Opened Oct 6, 2025
Broken JUnit-like XML report files Open

bug

Difficulty 5/5 Over a week Newbie friendliness 25/100

PyCQA/bandit#1304 · Opened Sep 25, 2025
not distinguishing sql statement with mixed stringbased query construction and sanitised parameterised sql query Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

PyCQA/bandit#1302 · Opened Sep 17, 2025
Add report formatter for Github Actions annotations Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 68/100

PyCQA/bandit#1301 · 7 comments · Opened Sep 16, 2025
B614 False Positive when using torch.jit.load Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

PyCQA/bandit#1293 · Opened Aug 27, 2025
bandit version and documentation reference in pre-commit run Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 42/100

PyCQA/bandit#1280 · 1 comment · Opened Jun 24, 2025
Allow customising colours Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

PyCQA/bandit#1271 · 4 comments · 5 reactions · Opened Jun 11, 2025
pysnmp under new ownership with breaking compatilbility Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

PyCQA/bandit#1264 · 1 comment · Opened May 5, 2025
Consider using argparse-manpage to build the man page from argparse Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 42/100

PyCQA/bandit#1256 · Opened Apr 6, 2025
Pre-commit hook unable to encode non ascii characters Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

PyCQA/bandit#1251 · Opened Mar 26, 2025
bug(standard_streams): console messages with the prefix “[main] INFO” if the configuration file in the INI format Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

PyCQA/bandit#1250 · Opened Mar 24, 2025
feature_request(verbose): “--verbose” command-line argument without the “Files excluded” section Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

PyCQA/bandit#1249 · Opened Mar 23, 2025
blacklist cloudpickle in pickle blacklist Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 45/100

PyCQA/bandit#1236 · Opened Feb 21, 2025
Support AI powered suggestion of fixes Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

PyCQA/bandit#1214 · 2 comments · 1 reaction · Opened Dec 30, 2024
#nosec BXXX does not contribute to `Total lines skipped (#nosec)` Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

PyCQA/bandit#1205 · 1 comment · Opened Nov 21, 2024
f-strings marked with a `# nosec BXXX` show an incorrect warning about no failed tests appears Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

PyCQA/bandit#1204 · 4 comments · 1 reaction · Opened Nov 21, 2024
pre-commit hook can't read version --> wrong URL generated Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

PyCQA/bandit#1202 · 4 comments · Opened Nov 18, 2024
Expand `B404, B602, B603 and B604` to include anyio calls Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 38/100

PyCQA/bandit#1199 · 1 reaction · Opened Nov 11, 2024
Create a control flow graph to traverse code in possible execution order Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

PyCQA/bandit#1197 · 2 comments · 1 reaction · Opened Nov 5, 2024
Bandit Skipping Directory and Unable to Output Report Error Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

PyCQA/bandit#1190 · 1 comment · Opened Oct 11, 2024
Add a custom plugin from configuration instead of setuptools Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

PyCQA/bandit#1188 · 1 reaction · Opened Oct 8, 2024
bandit does not consistently detect extractall with TarFile Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 48/100

PyCQA/bandit#1171 · 1 comment · Opened Sep 3, 2024
complaining the feature that i am not using in the python library Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

PyCQA/bandit#1164 · Opened Aug 8, 2024

PyCQA/bandit

Get new issues in your inbox