Home / PyCQA / bandit
AI Slop Code RIsk Monitor

PyCQA/bandit

Bandit is a tool designed to find common security issues in Python code.

13.2 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for PyCQA/bandit, a Python project with 8,304 GitHub stars. SynthScan examined 27,330 lines of code across 218 source files, recording 276 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 13.2 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

13.2
Adjusted Signal
13.2
Raw Pattern Score
100%
Time Factor
2026-10-06
Last Push
8.3K
Stars
Python
Language
27.3K
Lines of Code
218
Files
276
Pattern Hits
2026-10-12
Scan Date
0.08
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 31.0/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 198 finding(s).

Hallucinated Dependency & Supply Chain Risk 7.6/100 · LOW

Are imports declared and package/API names verified? 39 finding(s).

Agent Over-Engineering Ratio 38.6/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 191 finding(s).

PR Review Velocity Impact 50.2/100 · HIGH

Which changes need focused human review? 276 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 17MEDIUM 10LOW 249

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 276 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers151 hits · 152 pts
SeverityFileLineSnippetContext
LOWCONTRIBUTING.md226 def prohibit_unsafe_deserialization(context):CODE
LOWtests/unit/core/test_issue.py54 def test_issue_filter_severity(self):CODE
LOWtests/unit/core/test_issue.py65 def test_issue_filter_confidence(self):CODE
LOW⚡tests/unit/core/test_util.py100 def test_get_module_qualname_from_path_abs_typical(self):CODE
LOW⚡tests/unit/core/test_util.py110 def test_get_module_qualname_from_path_with_dot(self):CODE
LOW⚡tests/unit/core/test_util.py119 def test_get_module_qualname_from_path_abs_missingmid(self):CODE
LOW⚡tests/unit/core/test_util.py141 def test_get_module_qualname_from_path_abs_syms(self):CODE
LOW⚡tests/unit/core/test_util.py151 def test_get_module_qualname_from_path_rel_typical(self):CODE
LOW⚡tests/unit/core/test_util.py161 def test_get_module_qualname_from_path_rel_missingmid(self):CODE
LOW⚡tests/unit/core/test_util.py193 def test_get_module_qualname_from_path_rel_syms(self):CODE
LOW⚡tests/unit/core/test_util.py202 def test_get_module_qualname_from_path_sys(self):CODE
LOW⚡tests/unit/core/test_util.py212 def test_get_module_qualname_from_path_invalid_path(self):CODE
LOW⚡tests/unit/core/test_util.py218 def test_get_module_qualname_from_path_dir(self):CODE
LOW⚡tests/unit/core/test_util.py280 def test_path_for_function_no_file(self):CODE
LOW⚡tests/unit/core/test_util.py283 def test_path_for_function_no_module(self):CODE
LOW⚡tests/unit/core/test_util.py286 def test_escaped_representation_simple(self):CODE
LOW⚡tests/unit/core/test_util.py290 def test_escaped_representation_valid_not_printable(self):CODE
LOW⚡tests/unit/core/test_util.py294 def test_escaped_representation_invalid(self):CODE
LOW⚡tests/unit/core/test_util.py298 def test_escaped_representation_mixed(self):CODE
LOWtests/unit/core/test_util.py29 def _setup_get_module_qualname_from_path(self):CODE
LOWtests/unit/core/test_util.py130 def test_get_module_qualname_from_path_abs_missingend(self):CODE
LOWtests/unit/core/test_util.py177 def test_get_module_qualname_from_path_rel_missingend(self):CODE
LOWtests/unit/core/test_util.py231 def test_namespace_path_split(self):CODE
LOWtests/unit/core/test_util.py338 def test_check_ast_node_bad_node(self):CODE
LOWtests/unit/core/test_util.py341 def test_check_ast_node_bad_type(self):CODE
LOWtests/unit/core/test_blacklisting.py23 def test_report_issue_defaults(self):CODE
LOWtests/unit/core/test_config.py192 def test_converted_blacklist_call_data(self):STRING
LOWtests/unit/core/test_config.py208 def test_converted_blacklist_import_data(self):STRING
LOW⚡tests/unit/core/test_config.py223 def test_converted_blacklist_call_test(self):STRING
LOW⚡tests/unit/core/test_config.py229 def test_converted_blacklist_import_test(self):STRING
LOW⚡tests/unit/core/test_config.py235 def test_converted_exclude_blacklist(self):STRING
LOWtests/unit/core/test_context.py61 def test_call_function_name_qual(self):CODE
LOWtests/unit/core/test_context.py117 def test_function_def_defaults_qual(self, get_qual_attr):CODE
LOWtests/unit/core/test_context.py173 def test_check_call_arg_value(self, call_keywords):CODE
LOWtests/unit/core/test_context.py190 def test_get_lineno_for_call_arg(self, node):CODE
LOWtests/unit/core/test_context.py204 def test_get_call_arg_at_position(self):CODE
LOW⚡tests/unit/core/test_context.py222 def test_is_module_being_imported(self):CODE
LOW⚡tests/unit/core/test_context.py231 def test_is_module_imported_exact(self):CODE
LOW⚡tests/unit/core/test_context.py240 def test_is_module_imported_like(self):CODE
LOWtests/unit/core/test_manager.py49 def test_create_manager_with_profile(self):CODE
LOWtests/unit/core/test_manager.py130 def test_populate_baseline_success(self):CODE
LOWtests/unit/core/test_manager.py171 def test_populate_baseline_invalid_json(self, mock_logger_warning):STRING
LOWtests/unit/core/test_manager.py195 def test_output_results_invalid_format(self):CODE
LOWtests/unit/core/test_manager.py209 def test_output_results_valid_format(self):CODE
LOW⚡tests/unit/core/test_manager.py224 def test_discover_files_recurse_skip(self, isdir):CODE
LOW⚡tests/unit/core/test_manager.py231 def test_discover_files_recurse_files(self, isdir):CODE
LOW⚡tests/unit/core/test_manager.py240 def test_discover_files_exclude(self, isdir):CODE
LOW⚡tests/unit/core/test_manager.py249 def test_discover_files_exclude_dir(self, isdir):CODE
LOWtests/unit/core/test_manager.py276 def test_discover_files_exclude_cmdline(self, isdir):CODE
LOW⚡tests/unit/core/test_manager.py287 def test_discover_files_exclude_glob(self, isdir):CODE
LOW⚡tests/unit/core/test_manager.py296 def test_discover_files_include(self, isdir):CODE
LOW⚡tests/unit/core/test_manager.py304 def test_run_tests_keyboardinterrupt(self):CODE
LOWtests/unit/core/test_manager.py364 def test_find_candidate_matches(self):CODE
LOW⚡tests/unit/core/test_test_set.py82 def test_profile_include_none(self):CODE
LOW⚡tests/unit/core/test_test_set.py87 def test_profile_exclude_none(self):CODE
LOW⚡tests/unit/core/test_test_set.py92 def test_profile_has_builtin_blacklist(self):CODE
LOW⚡tests/unit/core/test_test_set.py98 def test_profile_exclude_builtin_blacklist(self):CODE
LOW⚡tests/unit/core/test_test_set.py105 def test_profile_exclude_builtin_blacklist_specific(self):CODE
LOW⚡tests/unit/core/test_test_set.py112 def test_profile_filter_blacklist_none(self):CODE
LOW⚡tests/unit/core/test_test_set.py120 def test_profile_filter_blacklist_one(self):CODE
91 more matches not shown…
Cross-File Repetition10 hits · 50 pts
SeverityFileLineSnippetContext
HIGHbandit/formatters/html.py0prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file obSTRING
HIGHbandit/formatters/xml.py0prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file obSTRING
HIGHbandit/formatters/sarif.py0prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file obSTRING
HIGHbandit/formatters/yaml.py0prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file obSTRING
HIGHbandit/formatters/csv.py0prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file obSTRING
HIGHbandit/formatters/text.py0prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file obSTRING
HIGHbandit/formatters/json.py0prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file obSTRING
HIGHbandit/cli/baseline.py0bandit is a tool designed to find common security issues in python code.STRING
HIGHbandit/cli/config_generator.py0bandit is a tool designed to find common security issues in python code.STRING
HIGHbandit/cli/main.py0bandit is a tool designed to find common security issues in python code.STRING
Unused Imports38 hits · 38 pts
SeverityFileLineSnippetContext
LOWbandit/__init__.py7CODE
LOWbandit/__init__.py8CODE
LOWbandit/__init__.py9CODE
LOWbandit/__init__.py10CODE
LOWbandit/__init__.py11CODE
LOWbandit/__init__.py12CODE
LOWbandit/__init__.py13CODE
LOWbandit/__init__.py14CODE
LOWbandit/__init__.py15CODE
LOWbandit/__init__.py16CODE
LOWbandit/__init__.py17CODE
LOWbandit/core/__init__.py5CODE
LOWbandit/core/__init__.py6CODE
LOWbandit/core/__init__.py7CODE
LOWbandit/core/__init__.py8CODE
LOWbandit/core/__init__.py9CODE
LOWbandit/core/__init__.py10CODE
LOWbandit/core/__init__.py11CODE
LOWbandit/core/__init__.py12CODE
LOWbandit/core/__init__.py13CODE
LOWbandit/core/__init__.py14CODE
LOWbandit/core/__init__.py15CODE
LOWexamples/imports-from.py1CODE
LOWexamples/imports-from.py3CODE
LOWexamples/imports-from.py4CODE
LOWexamples/imports-from.py5CODE
LOWexamples/imports-from.py6CODE
LOWexamples/imports-from.py7CODE
LOWexamples/ciphers.py16CODE
LOWexamples/sql_statements.py1CODE
LOWexamples/imports.py1CODE
LOWexamples/imports.py2CODE
LOWexamples/imports.py3CODE
LOWexamples/imports.py4CODE
LOWexamples/xml_xmlrpc.py1CODE
LOWexamples/sql_multiline_statements.py1CODE
LOWexamples/eval.py1CODE
LOWexamples/imports-aliases.py7CODE
Empty Error Handlers6 hits · 30 pts
SeverityFileLineSnippetContext
HIGHbandit/core/utils.py387except AttributeError: # nosec(tkelsey): catching expected exceptionCODE
HIGHbandit/core/manager.py320except tokenize.TokenError:CODE
HIGHbandit/formatters/screen.py52except ImportError:CODE
HIGHexamples/try_except_pass.py4except:CODE
HIGHexamples/try_except_pass.py11except Exception:CODE
HIGHexamples/try_except_pass.py18except ZeroDivisionError:CODE
Deep Nesting29 hits · 29 pts
SeverityFileLineSnippetContext
LOWtests/functional/test_functional.py87CODE
LOWbandit/core/metrics.py88CODE
LOWbandit/core/tester.py26CODE
LOWbandit/core/config.py26CODE
LOWbandit/core/blacklisting.py21CODE
LOWbandit/core/context.py175CODE
LOWbandit/core/docs_utils.py8CODE
LOWbandit/core/node_visitor.py238CODE
LOWbandit/core/manager.py200CODE
LOWbandit/core/manager.py261CODE
LOWbandit/core/manager.py301CODE
LOWbandit/plugins/hashlib_insecure_functions.py56CODE
LOWbandit/plugins/injection_sql.py87CODE
LOWbandit/plugins/general_bad_file_permissions.py74CODE
LOWbandit/plugins/injection_shell.py81CODE
LOWbandit/plugins/injection_shell.py110CODE
LOWbandit/plugins/django_xss.py85CODE
LOWbandit/plugins/django_xss.py132CODE
LOWbandit/plugins/django_xss.py194CODE
LOWbandit/plugins/django_xss.py28CODE
LOWbandit/plugins/django_sql_injection.py22CODE
LOWbandit/plugins/ssh_no_host_key_verification.py47CODE
LOWbandit/plugins/injection_wildcard.py113CODE
LOWbandit/plugins/insecure_ssl_tls.py34CODE
LOWbandit/plugins/general_hardcoded_password.py30CODE
LOWbandit/plugins/jinja2_templates.py75CODE
LOWbandit/cli/config_generator.py142CODE
LOWbandit/cli/main.py46CODE
LOWbandit/cli/main.py134CODE
Excessive Try-Catch Wrapping21 hits · 28 pts
SeverityFileLineSnippetContext
LOWbandit/core/tester.py120 except Exception as e:CODE
LOWbandit/core/utils.py72 except Exception:CODE
LOWbandit/core/manager.py101 except Exception as e:CODE
LOWbandit/core/manager.py194 except Exception as e:CODE
LOWbandit/core/manager.py332 except Exception as e:CODE
MEDIUMbandit/core/manager.py301def _parse_file(self, fname, fdata, new_files_list):CODE
LOWbandit/plugins/try_except_pass.py22 except Exception:CODE
LOWbandit/plugins/try_except_continue.py23 except Exception:CODE
LOWbandit/cli/config_generator.py197 except Exception as e:CODE
LOW⚡examples/mark_safe_insecure.py20 except Exception:CODE
LOW⚡examples/mark_safe_insecure.py28 except Exception:CODE
LOW⚡examples/mark_safe_insecure.py37 except Exception:CODE
LOWexamples/mark_safe_insecure.py48 except Exception:CODE
MEDIUMexamples/mark_safe_insecure.py17def try_insecure(cls='" onload="alert(\'xss\')'):CODE
MEDIUMexamples/mark_safe_insecure.py25def except_insecure(cls='" onload="alert(\'xss\')'):CODE
MEDIUMexamples/mark_safe_insecure.py33def try_else_insecure(cls='" onload="alert(\'xss\')'):CODE
MEDIUMexamples/mark_safe_insecure.py44def finally_insecure(cls='" onload="alert(\'xss\')'):CODE
LOWexamples/try_except_pass.py11except Exception:CODE
LOWexamples/try_except_continue.py13 except Exception:CODE
LOWexamples/mark_safe_secure.py23 except Exception:CODE
MEDIUMexamples/mark_safe_secure.py20def try_secure():CODE
Redundant / Tautological Comments12 hits · 12 pts
SeverityFileLineSnippetContext
LOWbandit/plugins/django_xss.py201 # Check if the var are secureCOMMENT
LOWbandit/plugins/trojansource.py22 4 if access_level != 'none‮⁦': # Check if admin ⁩⁦' and access_level != 'userCODE
LOW⚡bandit/plugins/huggingface_unsafe_download.py77 # Check if any HuggingFace-related modules are importedSTRING
LOW⚡bandit/plugins/huggingface_unsafe_download.py84 # Check if any HF modules are importedSTRING
LOW⚡bandit/plugins/huggingface_unsafe_download.py133 # Check if a revision or commit_id is specifiedSTRING
LOW⚡bandit/plugins/huggingface_unsafe_download.py137 # Check if it's a secure revision (looks like a commit hash)STRING
LOW⚡bandit/plugins/huggingface_unsafe_download.py143 # Check if it looks like a commit hash (hexadecimal string)STRING
LOWbandit/plugins/jinja2_templates.py106 # Check if select_autoescape function is used.STRING
LOWbandit/cli/main.py430 # Check if `--msg-template` is not present without custom formatterCOMMENT
LOWbandit/cli/main.py434 # Check if confidence or severity level have been specified with stringsCOMMENT
LOWexamples/trojansource.py4if access_level != 'none‮⁦': # Check if admin ⁩⁦' and access_level != 'userCODE
LOWexamples/trojansource_latin1.py6if access_level != 'none??': # Check if admin ??' and access_level != 'userCODE
Decorative Section Separators2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMexamples/huggingface_unsafe_download.py96# -------------------------------COMMENT
MEDIUMexamples/huggingface_unsafe_download.py98# -------------------------------COMMENT
Cross-Language Confusion1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHexamples/subprocess_shell.py43subprocess.Popen('/bin/ls && cat /etc/passwd', shell=True)CODE
AI Slop Vocabulary2 hits · 4 pts
SeverityFileLineSnippetContext
LOWbandit/core/utils.py74 # qualified name for an attr, just return its base name.COMMENT
MEDIUMbandit/cli/main.py99 # Certainly a value is passed to command lineCOMMENT
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMexamples/long_set.py1# This file contains a single long_set with 7276 'a' elementsCOMMENT
Over-Commented Block2 hits · 2 pts
SeverityFileLineSnippetContext
LOWbandit/cli/baseline.py1#COMMENT
LOWbandit/cli/config_generator.py21# '{cli}'COMMENT
AI Structural Patterns1 hit · 1 pts
SeverityFileLineSnippetContext
LOWbandit/core/issue.py80CODE