PyCQA/bandit

12.1

Adjusted Score

12.1

Raw Score

100%

Time Factor

2026-07-13

Last Push

8.2K

Stars

Python

Language

27.3K

Lines of Code

218

Files

270

Pattern Hits

2026-07-14

Scan Date

0.05

HC Hit Rate

What These Metrics Mean

Adjusted Score: Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score: The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor: The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits: Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate: High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files: Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 11MEDIUM 10LOW 249

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 270 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Hyper-Verbose Identifiers151 hits · 152 pts

Severity	File	Line	Snippet	Context
LOW	CONTRIBUTING.md	226	def prohibit_unsafe_deserialization(context):	CODE
LOW	tests/unit/core/test_issue.py	54	def test_issue_filter_severity(self):	CODE
LOW	tests/unit/core/test_issue.py	65	def test_issue_filter_confidence(self):	CODE
LOW⚡	tests/unit/core/test_util.py	100	def test_get_module_qualname_from_path_abs_typical(self):	CODE
LOW⚡	tests/unit/core/test_util.py	110	def test_get_module_qualname_from_path_with_dot(self):	CODE
LOW⚡	tests/unit/core/test_util.py	119	def test_get_module_qualname_from_path_abs_missingmid(self):	CODE
LOW⚡	tests/unit/core/test_util.py	141	def test_get_module_qualname_from_path_abs_syms(self):	CODE
LOW⚡	tests/unit/core/test_util.py	151	def test_get_module_qualname_from_path_rel_typical(self):	CODE
LOW⚡	tests/unit/core/test_util.py	161	def test_get_module_qualname_from_path_rel_missingmid(self):	CODE
LOW⚡	tests/unit/core/test_util.py	193	def test_get_module_qualname_from_path_rel_syms(self):	CODE
LOW⚡	tests/unit/core/test_util.py	202	def test_get_module_qualname_from_path_sys(self):	CODE
LOW⚡	tests/unit/core/test_util.py	212	def test_get_module_qualname_from_path_invalid_path(self):	CODE
LOW⚡	tests/unit/core/test_util.py	218	def test_get_module_qualname_from_path_dir(self):	CODE
LOW⚡	tests/unit/core/test_util.py	280	def test_path_for_function_no_file(self):	CODE
LOW⚡	tests/unit/core/test_util.py	283	def test_path_for_function_no_module(self):	CODE
LOW⚡	tests/unit/core/test_util.py	286	def test_escaped_representation_simple(self):	CODE
LOW⚡	tests/unit/core/test_util.py	290	def test_escaped_representation_valid_not_printable(self):	CODE
LOW⚡	tests/unit/core/test_util.py	294	def test_escaped_representation_invalid(self):	CODE
LOW⚡	tests/unit/core/test_util.py	298	def test_escaped_representation_mixed(self):	CODE
LOW	tests/unit/core/test_util.py	29	def _setup_get_module_qualname_from_path(self):	CODE
LOW	tests/unit/core/test_util.py	130	def test_get_module_qualname_from_path_abs_missingend(self):	CODE
LOW	tests/unit/core/test_util.py	177	def test_get_module_qualname_from_path_rel_missingend(self):	CODE
LOW	tests/unit/core/test_util.py	231	def test_namespace_path_split(self):	CODE
LOW	tests/unit/core/test_util.py	338	def test_check_ast_node_bad_node(self):	CODE
LOW	tests/unit/core/test_util.py	341	def test_check_ast_node_bad_type(self):	CODE
LOW	tests/unit/core/test_blacklisting.py	23	def test_report_issue_defaults(self):	CODE
LOW	tests/unit/core/test_config.py	192	def test_converted_blacklist_call_data(self):	STRING
LOW	tests/unit/core/test_config.py	208	def test_converted_blacklist_import_data(self):	STRING
LOW⚡	tests/unit/core/test_config.py	223	def test_converted_blacklist_call_test(self):	STRING
LOW⚡	tests/unit/core/test_config.py	229	def test_converted_blacklist_import_test(self):	STRING
LOW⚡	tests/unit/core/test_config.py	235	def test_converted_exclude_blacklist(self):	STRING
LOW	tests/unit/core/test_context.py	61	def test_call_function_name_qual(self):	CODE
LOW	tests/unit/core/test_context.py	117	def test_function_def_defaults_qual(self, get_qual_attr):	CODE
LOW	tests/unit/core/test_context.py	173	def test_check_call_arg_value(self, call_keywords):	CODE
LOW	tests/unit/core/test_context.py	190	def test_get_lineno_for_call_arg(self, node):	CODE
LOW	tests/unit/core/test_context.py	204	def test_get_call_arg_at_position(self):	CODE
LOW⚡	tests/unit/core/test_context.py	222	def test_is_module_being_imported(self):	CODE
LOW⚡	tests/unit/core/test_context.py	231	def test_is_module_imported_exact(self):	CODE
LOW⚡	tests/unit/core/test_context.py	240	def test_is_module_imported_like(self):	CODE
LOW	tests/unit/core/test_manager.py	49	def test_create_manager_with_profile(self):	CODE
LOW	tests/unit/core/test_manager.py	130	def test_populate_baseline_success(self):	CODE
LOW	tests/unit/core/test_manager.py	171	def test_populate_baseline_invalid_json(self, mock_logger_warning):	STRING
LOW	tests/unit/core/test_manager.py	195	def test_output_results_invalid_format(self):	CODE
LOW	tests/unit/core/test_manager.py	209	def test_output_results_valid_format(self):	CODE
LOW⚡	tests/unit/core/test_manager.py	224	def test_discover_files_recurse_skip(self, isdir):	CODE
LOW⚡	tests/unit/core/test_manager.py	231	def test_discover_files_recurse_files(self, isdir):	CODE
LOW⚡	tests/unit/core/test_manager.py	240	def test_discover_files_exclude(self, isdir):	CODE
LOW⚡	tests/unit/core/test_manager.py	249	def test_discover_files_exclude_dir(self, isdir):	CODE
LOW	tests/unit/core/test_manager.py	276	def test_discover_files_exclude_cmdline(self, isdir):	CODE
LOW⚡	tests/unit/core/test_manager.py	287	def test_discover_files_exclude_glob(self, isdir):	CODE
LOW⚡	tests/unit/core/test_manager.py	296	def test_discover_files_include(self, isdir):	CODE
LOW⚡	tests/unit/core/test_manager.py	304	def test_run_tests_keyboardinterrupt(self):	CODE
LOW	tests/unit/core/test_manager.py	364	def test_find_candidate_matches(self):	CODE
LOW⚡	tests/unit/core/test_test_set.py	82	def test_profile_include_none(self):	CODE
LOW⚡	tests/unit/core/test_test_set.py	87	def test_profile_exclude_none(self):	CODE
LOW⚡	tests/unit/core/test_test_set.py	92	def test_profile_has_builtin_blacklist(self):	CODE
LOW⚡	tests/unit/core/test_test_set.py	98	def test_profile_exclude_builtin_blacklist(self):	CODE
LOW⚡	tests/unit/core/test_test_set.py	105	def test_profile_exclude_builtin_blacklist_specific(self):	CODE
LOW⚡	tests/unit/core/test_test_set.py	112	def test_profile_filter_blacklist_none(self):	CODE
LOW⚡	tests/unit/core/test_test_set.py	120	def test_profile_filter_blacklist_one(self):	CODE
91 more matches not shown…

Cross-File Repetition10 hits · 50 pts

Severity	File	Snippet	Context
HIGH	bandit/formatters/html.py	prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file ob	STRING
HIGH	bandit/formatters/xml.py	prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file ob	STRING
HIGH	bandit/formatters/sarif.py	prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file ob	STRING
HIGH	bandit/formatters/yaml.py	prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file ob	STRING
HIGH	bandit/formatters/csv.py	prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file ob	STRING
HIGH	bandit/formatters/text.py	prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file ob	STRING
HIGH	bandit/formatters/json.py	prints discovered issues in the text format :param manager: the bandit manager object :param fileobj: the output file ob	STRING
HIGH	bandit/cli/baseline.py	bandit is a tool designed to find common security issues in python code.	STRING
HIGH	bandit/cli/config_generator.py	bandit is a tool designed to find common security issues in python code.	STRING
HIGH	bandit/cli/main.py	bandit is a tool designed to find common security issues in python code.	STRING

Unused Imports38 hits · 38 pts

Severity	File	Line	Context
LOW	bandit/__init__.py	7	CODE
LOW	bandit/__init__.py	8	CODE
LOW	bandit/__init__.py	9	CODE
LOW	bandit/__init__.py	10	CODE
LOW	bandit/__init__.py	11	CODE
LOW	bandit/__init__.py	12	CODE
LOW	bandit/__init__.py	13	CODE
LOW	bandit/__init__.py	14	CODE
LOW	bandit/__init__.py	15	CODE
LOW	bandit/__init__.py	16	CODE
LOW	bandit/__init__.py	17	CODE
LOW	bandit/core/__init__.py	5	CODE
LOW	bandit/core/__init__.py	6	CODE
LOW	bandit/core/__init__.py	7	CODE
LOW	bandit/core/__init__.py	8	CODE
LOW	bandit/core/__init__.py	9	CODE
LOW	bandit/core/__init__.py	10	CODE
LOW	bandit/core/__init__.py	11	CODE
LOW	bandit/core/__init__.py	12	CODE
LOW	bandit/core/__init__.py	13	CODE
LOW	bandit/core/__init__.py	14	CODE
LOW	bandit/core/__init__.py	15	CODE
LOW	examples/imports-from.py	1	CODE
LOW	examples/imports-from.py	3	CODE
LOW	examples/imports-from.py	4	CODE
LOW	examples/imports-from.py	5	CODE
LOW	examples/imports-from.py	6	CODE
LOW	examples/imports-from.py	7	CODE
LOW	examples/ciphers.py	16	CODE
LOW	examples/sql_statements.py	1	CODE
LOW	examples/imports.py	1	CODE
LOW	examples/imports.py	2	CODE
LOW	examples/imports.py	3	CODE
LOW	examples/imports.py	4	CODE
LOW	examples/xml_xmlrpc.py	1	CODE
LOW	examples/sql_multiline_statements.py	1	CODE
LOW	examples/eval.py	1	CODE
LOW	examples/imports-aliases.py	7	CODE

Deep Nesting29 hits · 29 pts

Severity	File	Line	Context
LOW	tests/functional/test_functional.py	87	CODE
LOW	bandit/core/metrics.py	88	CODE
LOW	bandit/core/tester.py	26	CODE
LOW	bandit/core/config.py	26	CODE
LOW	bandit/core/blacklisting.py	21	CODE
LOW	bandit/core/context.py	175	CODE
LOW	bandit/core/docs_utils.py	8	CODE
LOW	bandit/core/node_visitor.py	238	CODE
LOW	bandit/core/manager.py	200	CODE
LOW	bandit/core/manager.py	261	CODE
LOW	bandit/core/manager.py	301	CODE
LOW	bandit/plugins/hashlib_insecure_functions.py	56	CODE
LOW	bandit/plugins/injection_sql.py	87	CODE
LOW	bandit/plugins/general_bad_file_permissions.py	74	CODE
LOW	bandit/plugins/injection_shell.py	81	CODE
LOW	bandit/plugins/injection_shell.py	110	CODE
LOW	bandit/plugins/django_xss.py	85	CODE
LOW	bandit/plugins/django_xss.py	132	CODE
LOW	bandit/plugins/django_xss.py	194	CODE
LOW	bandit/plugins/django_xss.py	28	CODE
LOW	bandit/plugins/django_sql_injection.py	22	CODE
LOW	bandit/plugins/ssh_no_host_key_verification.py	47	CODE
LOW	bandit/plugins/injection_wildcard.py	113	CODE
LOW	bandit/plugins/insecure_ssl_tls.py	34	CODE
LOW	bandit/plugins/general_hardcoded_password.py	30	CODE
LOW	bandit/plugins/jinja2_templates.py	75	CODE
LOW	bandit/cli/config_generator.py	142	CODE
LOW	bandit/cli/main.py	46	CODE
LOW	bandit/cli/main.py	134	CODE

Excessive Try-Catch Wrapping21 hits · 28 pts

Severity	File	Line	Snippet	Context
LOW	bandit/core/tester.py	120	except Exception as e:	CODE
LOW	bandit/core/utils.py	72	except Exception:	CODE
LOW	bandit/core/manager.py	101	except Exception as e:	CODE
LOW	bandit/core/manager.py	194	except Exception as e:	CODE
LOW	bandit/core/manager.py	332	except Exception as e:	CODE
MEDIUM	bandit/core/manager.py	301	def _parse_file(self, fname, fdata, new_files_list):	CODE
LOW	bandit/plugins/try_except_pass.py	22	except Exception:	CODE
LOW	bandit/plugins/try_except_continue.py	23	except Exception:	CODE
LOW	bandit/cli/config_generator.py	197	except Exception as e:	CODE
LOW⚡	examples/mark_safe_insecure.py	20	except Exception:	CODE
LOW⚡	examples/mark_safe_insecure.py	28	except Exception:	CODE
LOW⚡	examples/mark_safe_insecure.py	37	except Exception:	CODE
LOW	examples/mark_safe_insecure.py	48	except Exception:	CODE
MEDIUM	examples/mark_safe_insecure.py	17	def try_insecure(cls='" onload="alert(\'xss\')'):	CODE
MEDIUM	examples/mark_safe_insecure.py	25	def except_insecure(cls='" onload="alert(\'xss\')'):	CODE
MEDIUM	examples/mark_safe_insecure.py	33	def try_else_insecure(cls='" onload="alert(\'xss\')'):	CODE
MEDIUM	examples/mark_safe_insecure.py	44	def finally_insecure(cls='" onload="alert(\'xss\')'):	CODE
LOW	examples/try_except_pass.py	11	except Exception:	CODE
LOW	examples/try_except_continue.py	13	except Exception:	CODE
LOW	examples/mark_safe_secure.py	23	except Exception:	CODE
MEDIUM	examples/mark_safe_secure.py	20	def try_secure():	CODE

Redundant / Tautological Comments12 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	bandit/plugins/django_xss.py	201	# Check if the var are secure	COMMENT
LOW	bandit/plugins/trojansource.py	22	4 if access_level != 'none‮⁦': # Check if admin ⁩⁦' and access_level != 'user	CODE
LOW⚡	bandit/plugins/huggingface_unsafe_download.py	77	# Check if any HuggingFace-related modules are imported	STRING
LOW⚡	bandit/plugins/huggingface_unsafe_download.py	84	# Check if any HF modules are imported	STRING
LOW⚡	bandit/plugins/huggingface_unsafe_download.py	133	# Check if a revision or commit_id is specified	STRING
LOW⚡	bandit/plugins/huggingface_unsafe_download.py	137	# Check if it's a secure revision (looks like a commit hash)	STRING
LOW⚡	bandit/plugins/huggingface_unsafe_download.py	143	# Check if it looks like a commit hash (hexadecimal string)	STRING
LOW	bandit/plugins/jinja2_templates.py	106	# Check if select_autoescape function is used.	STRING
LOW	bandit/cli/main.py	430	# Check if `--msg-template` is not present without custom formatter	COMMENT
LOW	bandit/cli/main.py	434	# Check if confidence or severity level have been specified with strings	COMMENT
LOW	examples/trojansource.py	4	if access_level != 'none‮⁦': # Check if admin ⁩⁦' and access_level != 'user	CODE
LOW	examples/trojansource_latin1.py	6	if access_level != 'none??': # Check if admin ??' and access_level != 'user	CODE

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/huggingface_unsafe_download.py	96	# -------------------------------	COMMENT
MEDIUM	examples/huggingface_unsafe_download.py	98	# -------------------------------	COMMENT

Cross-Language Confusion1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	examples/subprocess_shell.py	43	subprocess.Popen('/bin/ls && cat /etc/passwd', shell=True)	CODE

AI Slop Vocabulary2 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	bandit/core/utils.py	74	# qualified name for an attr, just return its base name.	COMMENT
MEDIUM	bandit/cli/main.py	99	# Certainly a value is passed to command line	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/long_set.py	1	# This file contains a single long_set with 7276 'a' elements	COMMENT

Over-Commented Block2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	bandit/cli/baseline.py	1	#	COMMENT
LOW	bandit/cli/config_generator.py	21	# '{cli}'	COMMENT

AI Structural Patterns1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	bandit/core/issue.py	80		CODE

Analysis Overview

What These Metrics Mean

Score History

Severity Breakdown

Directory Score Breakdown

Pattern Findings