False Negative under Python 3, reported if scanned under python 2.7

Project being scanned:

https://github.com/portantier/vulpy

The project is python 3 project.

Under https://github.com/portantier/vulpy/blob/master/bad/vulpy.py, line 16
app.config['SECRET_KEY'] = 'aaaaaaa'

should be reported under test_id B105 hardcoded_password_string.

The issue is being reported if the project is scanned under python 2.7 environment.

To Reproduce
Run Bandit under python 3 and python 2.7 for same project.

Expected behavior
The issue should be reported of both the python version.

Bandit version

bandit 1.6.2
  python version = 3.8.0 (default, Oct 15 2019, 23:14:07) [GCC 8.3.0]

Additional context
I am trying to scan known vulnerable applications with Bandit to compare results. since the project is using python3, got multiple errors while scanning under 2.7and while scanning under python 3 had no errors, the number of issues reported got reduced too.

Start by scanning the linked vulpy project, especially bad/vulpy.py line 16, with Bandit under Python 3 and Python 2.7, then compare the B105 hardcoded_password_string results. Done means the same SECRET_KEY assignment is reported in both environments without the additional errors described in the issue.