bandit -r

bandit -r <python-path>

Scans Python code with bandit, detecting insecure patterns (injections, execution, pickle, weak crypto) in the project.

Run it in the CI/CD pipeline of Python projects when you want static security analysis: bandit walks through the code and reports findings with severity and CWE — insecure calls (eval, exec, subprocess with shell), pickle, weak cryptographic functions (MD5, SHA1), use of unvalidated data. It's the community's reference Python SAST: fast and with language rules. In DevSecOps, bandit is the filter of the Python pipeline: a high-severity finding blocks the merge.

Don't use it as a complete analysis: bandit detects known patterns in Python code — logic vulnerabilities and dependency vulnerabilities (SCA, 022) are out of scope. False positives (legitimate uses of eval, trusted data) are triaged and silenced with # nosec. And note: bandit analyzes static code — it doesn't execute anything; runtime behavior (DAST) complements. For the pipeline, the JSON output (or CI format) integrates with the rest of the checks.