What Bandit checks

Bandit scans for patterns like:

• use of evaleval
• subprocesssubprocess calls without safety
• hardcoded passwords
• insecure temporary files

Run

bandit -r your_package

bandit -r your_package

Example finding

# Bandit will warn about eval usage
user_input = "2 + 2"
result = eval(user_input)

# Bandit will warn about eval usage
user_input = "2 + 2"
result = eval(user_input)

Tip

• Treat Bandit warnings as “review required”, not always “bug”.
• Combine with dependency scanning in CI.