What is Bandit?

Bandit is a tool designed for Python developers aiming to secure their codebase. It scans Python files, identifying common security issues as defined by its extensive test suite. Bandit flags problems like hard-coded passwords, injection vulnerabilities, and the use of insecure libraries, offering developers insights to mitigate potential security risks.

It primarily focuses on .py files, analyzing Python source code for security concerns. It's built to understand Python's syntax and semantics, making it adept at identifying issues in Python scripts, modules, and even snippets of Python code embedded in project files.

Installing Bandit

With Trunk Check, you can automatically install and configure Bandit along with any relevant linters in a few straightforward steps. Here's how:

First, if you haven't already installed Trunk CLI, you can do so with the command below:

1curl https://get.trunk.io -fsSL | bash

Next, you can initialize Trunk from the root of your git repository:

1trunk init

This command will scan your repository and create a .trunk/trunk.yaml file that enables all linters, formatters, and security analyzers, recommended by Trunk Check. This includes Bandit if applicable to your project.

To see all available linters Trunk Check installed, simply run:

1trunk check list

If you find Bandit is not automatically enabled, you can do so by running:

1trunk check enable bandit

Alternatively, to disable Bandit run the command below. To disable other tooling applied by Trunk Check, simply replace bandit with the respective tool you're looking to disable.

1trunk check disable bandit

For more details on Trunk Check setup, see here.

Configuring Bandit

Most linters provide some mechanism to tweak their configuration, e.g. .eslintrc or Cargo.toml. Trunk is aware of all the ways individual tools are configured and supports them. This means linters you've already configured will continue to work exactly the same, just now supercharged by Trunk Check.

Like many linters with Trunk, Bandit works out of the box so there's no need to set up a custom configuration. You can learn more about Bandit and its setup in our docs. For additional configuration like suppressing individual lines during scan, we recommend checking out Bandit's official docs.

If you're interested in other tooling outside of Bandit, check out our open-source repository to see how we define and support 90+ linters.

Running Bandit

To check your code with Bandit, run the command below. This command executes Bandit, along with any other linters Trunk Check has enabled on files you've modified. Since Trunk is git-aware, it knows what you've changed, and by adding batched execution and caching, you end up with a much faster and smoother way to run Bandit and other tools.

1trunk check

If you prefer to check files you've modified with Bandit only, run the following:

1trunk check --filter=bandit

Although we'd recommend against it depending on the size of your repository, you can check all files with Bandit by running the command below.

1trunk check --all --filter=bandit

In most scenarios, you'll want to execute against modified files. Since Trunk is git-aware, it knows what you've changed, and by adding batched execution and caching, you end up with a much faster and smoother way to run Bandit and other tools.

Updating Trunk Check & Bandit

To upgrade the Trunk CLI along with all plugins and linters in your trunk.yaml simply run:

1trunk upgrade

We highly recommend running on the latest validated versions of tools as updates will frequently include important security fixes and additional valuable checks. Trunk only auto-suggests linter upgrades to versions that we have tested and support, so you may see a slight lag time when a new linter version is released.

Upgrade will also recommend new tools that have become applicable since the last time your repository was scanned. This can be a result of using new technologies in your repository or Trunk itself adding support for more tools. If you don't like a particular recommendation, you can always run trunk check disable <linter> to teach trunk not to recommend it.

Recommended Linters to Pair with Bandit

While Bandit focuses on security, pairing it with other linters can significantly improve code quality and maintainability. Recommended linters to use alongside Bandit include:

• Flake8 for style guide enforcement and syntax errors.

• Pylint for a more comprehensive code quality check.

• Black for code formatting.

Combining these tools provides a robust linting setup that covers code style, quality, and security.