Install bandit with Homebrew, apt, MacPorts, Nix, pacman

Project links

• Homepage
• Upstream docs
• Package manager page

Commands and aliases

• bandit
• bandit-baseline
• bandit-config-generator

Project history

The official README says Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA. Its public Git history begins in July 2014, with 0.9.0 tagged in February 2015 and a steady 1.x release line since then.

Bandit's architecture reflects the Python tooling style of its era: it uses Python's AST module, reports issue IDs such as B101 and B602, and exposes command-line, baseline, and config-generation executables for local use and CI automation.

Adoption history

Bandit's adoption broadened from OpenStack security work into the general Python quality-tooling ecosystem after it moved under PyCQA. The supplied package facts list Homebrew, Debian/Ubuntu, MacPorts, Nix, Arch, and related packaging, and the official README advertises PyPI, container images, and GitHub Actions-built images.

The project also became part of common Python CI and pre-commit workflows: the official docs include integration and CI/CD sections, and the configuration docs show usage through pre-commit with the official PyCQA repository.

How it is used

Bandit scans Python source recursively, builds ASTs, runs security plugins, and emits reports. Common usage is local scanning with bandit -r ., CI enforcement, baseline comparison, and per-line suppression with nosec comments when a finding has been reviewed.

Configuration can live in a .bandit INI file for recursive project scans, or in YAML/TOML files such as bandit.yaml and pyproject.toml when passed with -c. The docs also describe generated configs and plugin-specific overrides.

Why package nerds care

Bandit matters in package catalogs because it is security tooling with a tiny operational footprint: easy to add to CI, easy to vendor into developer images, and easy for distributions to expose as a CLI.

It also illustrates the consolidation of Python QA tools under PyCQA, alongside linters and format-adjacent tooling that package managers routinely provide for reproducible developer environments.

Timeline

• 2014: Public Git history begins in the official repository.
• 2015: 0.9.0 is tagged, followed by frequent early releases.
• 2010s: Bandit moves from the OpenStack Security Project to PyCQA, according to the official README.
• 2020s: Bandit is distributed through PyPI, OS package managers, pre-commit workflows, and signed container images.
• 2026: 1.9.x releases continue maintenance of the analyzer and rule set.

Related projects

• Bandit is related to PyCQA tooling, Python's AST module, pre-commit, and broader Python security/static-analysis tools. It complements general-purpose linters by focusing specifically on common security issues.

Sources

• https://bandit.readthedocs.io/en/latest/config.html
• https://github.com/PyCQA/bandit
• https://github.com/PyCQA/bandit/blob/main/README.rst
• https://github.com/PyCQA/bandit/commit/c796659aea9bfb00088281bb2b6c1ef051839c18
• input.source_facts.package-manager