PyCQA / PyCQA/bandit

Should exit with non-zero code when scanning fails

Open
#1,326 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

When bandit is unable to scan one or more files (e.g. due to Python 3.14 as in #1219 or non-UTF-8 characters as in #882) it still exits with exit code 0, which is misleading and makes it more difficult to check the result programmatically (e.g. to fail a build in CI systems).

Reproduction steps
1. Run bandit using Python 3.14 in any project.
2. Observe that the "Files skipped" section of the output lists all .py files with "(exception while scanning file)" and the exit code is 0.
Expected behavior

bandit would exit with a non-zero exit code to indicate failure. (Perhaps code 2 to distinguish internal errors from failed tests which set exit code 1?)

Bandit version

1.8.3 (Default)

Python version

3.13 (Default)

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how Bandit reports files skipped with “exception while scanning file” and how the CLI selects its exit status. Reproduce the Python 3.14 or non-UTF-8 case, then add coverage for a non-zero status while preserving the existing status for failed tests. Done means scan failures are distinguishable programmatically.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.