Bandit

Bandit is a free security linter for Python source code. It suits developers and teams that want security checks embedded in editors, commits, or CI without adopting a hosted platform. The tradeoff is focus: Bandit addresses Python code rather than broad, multi-language application security.

Overview

Bandit parses Python into an abstract syntax tree (AST), applies security plugins to the resulting nodes, and produces a report after scanning files. That design keeps analysis close to the source and makes the tool appropriate for code-review gates and developer feedback. It is less suitable when you need runtime monitoring, dependency coverage, or a single scanner spanning several programming languages.

The project is open source under the Apache License 2.0. Installation comes from PyPI, with pip recommended in the documentation, so teams can add it to an existing Python toolchain rather than adopt a separate service.

Key features

Focused scanning and baselines

Bandit’s plugin-based AST analysis is aimed at common security issues in Python. Teams can create custom security rules when the built-in checks do not match internal coding standards. A JSON baseline can suppress findings already judged to be non-issues, which is useful when introducing scanning to an established repository; it manages accepted noise but does not expand detection coverage.

Output and workflow integration

Optional installation extras provide TOML support, the bandit-baseline command-line interface, and SARIF output formatting. SARIF can make results easier to consume in compatible security workflows, while the baseline utility simplifies ongoing suppression management.

Editor integrations cover Visual Studio Code, Sublime Text, Vim and Neovim, and Emacs. CI options include GitHub Actions and Jenkins, with additional integrations for Ruff and Flake8. Configuring Bandit as a repository pre-commit hook catches issues before changes reach a remote branch, making it practical for teams that prefer fast local feedback.

Container distribution

A published image on ghcr.io supports amd64, arm64, armv7, and armv8 architectures. Each image is signed with Sigstore Cosign, and the project provides a command to verify its source of origin. That is a useful supply-chain control for teams standardising scanner execution in containers.

For maintenance and security communication, the project points users to its GitHub issue tracker and Bandit Discord community. Vulnerability reports go through GitHub’s private vulnerability reporting, with a request to inform Tidelift security as well.

Pricing

Bandit — free (Free software; Apache License 2.0). There is no free trial because the software is free, and no paid tier or seat allowance is described. This suits individual Python developers, open-source projects, and organisations that can run and maintain their own tooling. The cost advantage comes with operational responsibility: Bandit is a scanner you install and integrate, not a managed security service.

Platforms

Bandit runs on Linux and macOS and is available as self-hosted software. Its PyPI distribution, pip installation path, editor and CI integrations, and multi-architecture container image support local and pipeline deployment. Windows is not among the supported platforms stated for this entry.

Who it's for

Choose Bandit if your primary target is Python source and you want a focused SAST check in an IDE, pre-commit workflow, or CI/CD pipeline. It is particularly well suited to teams that need custom rules or a baseline to control accepted findings, and to organisations that require self-hosted execution.

Look elsewhere if your estate spans many languages, if dependency or live-application analysis is central, or if you want a vendor-managed platform with usage plans and service features.

Pros and cons

Pros

• Free and Apache-licensed: there is no subscription cost or trial expiry, making broad internal deployment straightforward.
• Python-specific AST analysis: plugins target common Python security issues directly in source code.
• Workflow breadth: editor, pre-commit, GitHub Actions, Jenkins, Ruff, and Flake8 integrations support different development habits.
• Baseline and custom rules: teams can reduce recurring noise and adapt checks to internal requirements.
• Verified containers: signed images across four listed architectures support controlled self-hosted execution.

Cons

• Narrow language scope: Python source is the stated target, so polyglot estates need additional tooling.
• Self-managed operation: installation, integration, and result handling remain the team’s responsibility.
• Baseline is suppressive, not expansive: it keeps known findings quiet but does not add new detection categories.

Alternatives

Semgrep Code is the better choice for teams needing a broader platform across API, extension, Linux, macOS, self-hosted, web, and Windows deployments, with a free edition capped at 10 repositories, 10 contributors, and 60 AI credits.

Snyk Open Source fits teams prioritising open-source dependency analysis and a hosted option; its free plan covers five projects, while the Team plan costs $25 a month for up to 10 developers.

MobSF is a free GPL-3.0 framework for broader mobile-security workflows, with a Professional plan priced at $2,999.99 a year.

Flawfinder is another free, self-hosted code scanner, aimed at a different analysis focus and supporting Windows as well as Linux and macOS.

NaiveSystems Analyze offers a freemium alternative with some open-source components, including an on-premises analysis runner.

NodeJsScan is a free, open-source, self-hosted option for Node.js projects, available through Docker or local setup.

Bearer provides a free open SAST CLI for Linux and macOS without stated numeric limits.

Brakeman is a free vulnerability scanner for Ruby on Rails applications, with free non-commercial use noted by its GitHub README.

For broader comparisons, see SAST Tools and Static Application Security Testing Software.

Verdict

Bandit is the right choice for Python-focused teams that want a free, self-hosted security gate with editor, pre-commit, and CI integration, plus baselines and custom rules. Choose it for practical source-level Python checks; look elsewhere when you need multi-language coverage, dependency analysis, or a managed application-security platform.