Security oriented static analyser for python code.
Verified details
These details have been verified by PyPIProject links
Owner
GitHub Statistics
Maintainers
Project description
A security linter from PyCQA
Free software: Apache license
Documentation: https://bandit.readthedocs.io/en/latest/
Source: https://github.com/PyCQA/bandit
Contributing: https://github.com/PyCQA/bandit/blob/main/CONTRIBUTING.md
Overview
Bandit is a tool designed to find common security issues in Python code. To do this Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. Once Bandit has finished scanning all the files it generates a report.
Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA.
Show Your Style
Use our badge in your project’s README!
using Markdown:
[](https://github.com/PyCQA/bandit)
using RST:
.. image:: https://img.shields.io/badge/security-bandit-yellow.svg
:target: https://github.com/PyCQA/bandit
:alt: Security Status
References
Python AST module documentation: https://docs.python.org/3/library/ast.html
Green Tree Snakes - the missing Python AST docs: https://greentreesnakes.readthedocs.org/en/latest/
Documentation of the various types of AST nodes that Bandit currently covers or could be extended to cover: https://greentreesnakes.readthedocs.org/en/latest/nodes.html
Container Images
Bandit is available as a container image, built within the bandit repository using GitHub Actions. The image is available on ghcr.io:
docker pull ghcr.io/pycqa/bandit/banditThe image is built for the following architectures:
amd64
arm64
armv7
armv8
To pull a specific architecture, use the following format:
docker pull --platform=<architecture> ghcr.io/pycqa/bandit/bandit:latestEvery image is signed with sigstore cosign and it is possible to verify the source of origin using the following cosign command:
cosign verify ghcr.io/pycqa/bandit/bandit:latest \
--certificate-identity https://github.com/pycqa/bandit/.github/workflows/build-publish-image.yml@refs/tags/<version> \
--certificate-oidc-issuer https://token.actions.githubusercontent.comWhere <version> is the release version of Bandit.
Sponsors
The development of Bandit is made possible by the following sponsors:
|
|
If you also ❤️ Bandit, please consider sponsoring.
Project details
Verified details
These details have been verified by PyPIProject links
Owner
GitHub Statistics
Maintainers
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file bandit-1.8.0.tar.gz.
File metadata
- Download URL: bandit-1.8.0.tar.gz
- Upload date:
- Size: 4.2 MB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/5.1.1 CPython/3.12.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | b5bfe55a095abd9fe20099178a7c6c060f844bfd4fe4c76d28e35e4c52b9d31e |
|
| MD5 | 1fd5445b051f74593268bea092fdd8ae |
|
| BLAKE2b-256 | 57c3bea54f22cdc8224f0ace18b2cf86c6adf7010285d0ed51b703af9910c5b2 |
Provenance
The following attestation bundles were made for bandit-1.8.0.tar.gz:
Publisher:
publish-to-pypi.yml on PyCQA/bandit
-
Statement:
- Statement type:
https://in-toto.io/Statement/v1 - Predicate type:
https://docs.pypi.org/attestations/publish/v1 - Subject name:
bandit-1.8.0.tar.gz - Subject digest:
b5bfe55a095abd9fe20099178a7c6c060f844bfd4fe4c76d28e35e4c52b9d31e - Sigstore transparency entry: 151847183
- Sigstore integration time:
- Permalink:
PyCQA/bandit@8fd258abbac759d62863779f946d6a88e8eabb0f - Branch / Tag:
refs/tags/1.8.0 - Owner: https://github.com/PyCQA
- Access:
public
- Token Issuer:
https://token.actions.githubusercontent.com - Runner Environment:
github-hosted - Publication workflow:
publish-to-pypi.yml@8fd258abbac759d62863779f946d6a88e8eabb0f - Trigger Event:
workflow_dispatch
- Statement type:
File details
Details for the file bandit-1.8.0-py3-none-any.whl.
File metadata
- Download URL: bandit-1.8.0-py3-none-any.whl
- Upload date:
- Size: 127.0 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/5.1.1 CPython/3.12.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | b1a61d829c0968aed625381e426aa378904b996529d048f8d908fa28f6b13e38 |
|
| MD5 | 41b08272f8f39b91f744c647fb56c7b3 |
|
| BLAKE2b-256 | 246ba9f0574d05d63e7d8125cd02a52732adb6720a9b9f13c921386cb9cdb53e |
Provenance
The following attestation bundles were made for bandit-1.8.0-py3-none-any.whl:
Publisher:
publish-to-pypi.yml on PyCQA/bandit
-
Statement:
- Statement type:
https://in-toto.io/Statement/v1 - Predicate type:
https://docs.pypi.org/attestations/publish/v1 - Subject name:
bandit-1.8.0-py3-none-any.whl - Subject digest:
b1a61d829c0968aed625381e426aa378904b996529d048f8d908fa28f6b13e38 - Sigstore transparency entry: 151847185
- Sigstore integration time:
- Permalink:
PyCQA/bandit@8fd258abbac759d62863779f946d6a88e8eabb0f - Branch / Tag:
refs/tags/1.8.0 - Owner: https://github.com/PyCQA
- Access:
public
- Token Issuer:
https://token.actions.githubusercontent.com - Runner Environment:
github-hosted - Publication workflow:
publish-to-pypi.yml@8fd258abbac759d62863779f946d6a88e8eabb0f - Trigger Event:
workflow_dispatch
- Statement type:
