Bandit Python SAST

Overview

Bandit is a security-focused static analysis tool for Python that identifies common security vulnerabilities and coding anti-patterns. It parses Python code into Abstract Syntax Trees (AST) and executes security plugins to detect issues like hardcoded credentials, SQL injection, command injection, weak cryptography, and insecure API usage. Bandit provides actionable reports with severity classifications aligned to industry security standards.

Quick Start

Scan a Python file or directory for security vulnerabilities:

# Install Bandit
pip install bandit

# Scan single file
bandit suspicious_file.py

# Scan entire directory recursively
bandit -r /path/to/python/project