How Bandit Performs Static Analysis on Python Code

Bandit is a dedicated static application security testing (SAST) tool designed to identify common security flaws in Python code. It operates by converting raw Python files into an Abstract Syntax Tree (AST), scanning the structural nodes against an extensible collection of security-focused test plugins, and generating reports that rate identified vulnerabilities by severity and confidence. By analyzing syntax and context rather than raw text, Bandit enables developers to automate code reviews and catch potential security regressions directly within development and continuous integration environments.

Abstract Syntax Tree (AST) Generation

Instead of relying on regex pattern matching, Bandit leverages Python’s built-in ast module. When provided with a target directory or file, Bandit parses the source text into an Abstract Syntax Tree. This hierarchical tree representation breaks the code down into structural elements, such as module imports, function definitions, variable assignments, and function calls. Analyzing the AST allows Bandit to understand the programmatic structure and relationships within the code, significantly reducing false positives compared to simple text-search tools.

Node Traversal and Context Evaluation

Once the AST is built, Bandit traverses the tree using a Node Visitor pattern. As Bandit walks through each node of the AST, it evaluates the node's context. For instance, if Bandit encounters a Call node, it inspects:

• The exact name of the function being executed.
• The module from which the function was imported.
• The positional and keyword arguments passed to that call.
• Whether variable inputs originate from static literals or dynamic definitions.

This structural context ensures that security rules trigger only when specific, potentially dangerous programmatic conditions are met.

Plugin-Based Security Testing

Bandit organizes its analysis logic into modular test plugins. Each plugin is registered to watch for specific AST node types. When a matching node is encountered during the AST walk, the relevant plugin executes its evaluation logic.

Common security tests performed by Bandit plugins include:

• Unsafe Deserialization: Detecting calls to modules like pickle, marshal, or yaml.load without safe loaders, which can lead to remote code execution.
• Command Injection: Flagging invocations of execution functions such as subprocess.Popen or os.system where arguments like shell=True are used with dynamic inputs.
• Hardcoded Credentials: Identifying potential secrets, tokens, and passwords assigned to variables or passed as default parameters.
• Weak Cryptography: Detecting the use of outdated hash algorithms (e.g., MD5, SHA1) or insecure ciphers.
• Insecure Defaults and Configurations: Finding misconfigured settings such as binding network services to all interfaces (0.0.0.0), using insecure temporary files via tempfile.mktemp, or executing SQL queries constructed with raw string formatting.

Severity and Confidence Metrics

When a plugin discovers a vulnerability, Bandit assigns two distinct ratings to the issue:

1. Severity (Low, Medium, High): Measures the potential impact of the security flaw on the application if exploited.
2. Confidence (Low, Medium, High): Measures the likelihood that the reported issue represents an actual vulnerability rather than a false positive.

These ratings allow development teams to filter and prioritize findings, focusing immediately on high-severity, high-confidence flaws while ignoring lower-risk patterns according to their risk tolerance.

Configuration, Baseline, and Pipeline Execution

Bandit supports custom configuration through YAML files or pyproject.toml, where teams can disable specific plugins, customize test parameters, or specify file paths to exclude. To prevent redundant alerts on existing codebases, Bandit supports baseline reporting, which allows users to suppress previously known issues and only fail builds when new security flaws are introduced. Because it executes via the command line and outputs formats such as JSON, CSV, HTML, and SARIF, Bandit fits seamlessly into modern CI/CD pipelines to enforce static security standards before code is merged into production.