Bandit

Bandit is a command line security linter for Python. It catches common security issues like hardcoded passwords, weak cryptography, and unsafe use of shell commands, making it a fit for teams that want lightweight static analysis dedicated to Python.

Under the hood, Bandit parses each file into an abstract syntax tree and runs a set of plugins against the tree's nodes, then assembles the findings into a report. The plugin model means the checks it applies can be extended and tuned to a project's needs.

Bandit started inside the OpenStack Security Project and was later rehomed to PyCQA, the Python Code Quality Authority. It is free software under the Apache license, installable from PyPI or runnable as a container image, with source on GitHub.