Bandit
Security-focused static analyzer for identifying vulnerabilities in Python code.
Linting and formatting PyPI Apache-2.0
How Bandit is used
Bandit is a dependency in 12 of the 6,208 public GitHub projects set up for AI coding agents that we scanned, too few to describe it from them alone. Our scan also samples projects by dependency (Solana 2,661, Ethereum and EVM 1,496, 3D and games 2,818, agent frameworks and SDKs 10,983); counting those, it appears in 33 projects, and what it is used with below comes from all of them. The most used alternative in our scan is Ruff (54 projects). Projects that use it most often also use python-dotenv (87.9%), Pydantic (81.8%), pytest (81.8%).
Bandit popularity over time
Gid Score 57: downloads 81, use in agent projects 35, GitHub stars 47, downloads trend 54 (each 0-100). How it is calculated.
Often used with Bandit
| python-dotenv | 87.9% of Bandit projects · 9.6× more than average |
|---|---|
| Pydantic | 81.8% of Bandit projects · 9.5× more than average |
| pytest | 81.8% of Bandit projects · 19.9× more than average |
| Requests | 78.8% of Bandit projects · 11.6× more than average |
| FastAPI | 75.8% of Bandit projects · 10.1× more than average |
| Uvicorn | 75.8% of Bandit projects · 9.9× more than average |
| Black | 63.6% of Bandit projects · 50.6× more than average |
| mypy | 57.6% of Bandit projects · 76.0× more than average |
From all 33 projects in our scan that use Bandit, including the dependency samples.
By coding agent
| Claude Code | 0.2% of projects set up for it |
|---|---|
| GitHub Copilot | 0.3% of projects set up for it |
Share of public repos configured for each agent that list Bandit as a dependency.
How Bandit is funded
GitHub Sponsors
| @ericwb | 1 current sponsor |
|---|
GitHub shows how many people and companies sponsor an account, not how much they pay. Sponsors of a person back all of their work.
Ways to fund Bandit
GitHub Sponsors Own page Tidelift
As the maintainers list them in FUNDING.yml on GitHub. Checked Oct 20, 2026.
Install
| Package | pip install bandit |
|---|---|
| Main stacks | Python (32), Next.js (1) |
| Example projects | ZJU-REAL/HugAgentOS, AgnetLabs/Laddr, Femstar08/context-engineering-template, jeremylongshore/iam-bob-adk-python, MarcusJellinghaus/mcp-tools-py |
Alternatives to Bandit
Tools that do the same job, so a project picks one or the other. Add-ons and libraries used alongside Bandit are not listed here; they are in "Often used with".
| Tool | Gid Score | Used in agent projects | Downloads / wk | GitHub stars | License |
|---|---|---|---|---|---|
| Ruff pypi Extremely fast Python linter and code formatter written in Rust for modern projects. |
80 | 54 (3.3%) | 89.4M | 50.2K | MIT |
| flake8 pypi Modular Python linter combining PEP 8 style checking, PyFlakes and complexity analysis. |
62 | 44 (2.7%) | 9.7M | 3,828 | MIT |
| Checkov pypi Static analysis tool for infrastructure-as-code to detect security and compliance issues. |
51 | 26 (1.6%) | 1.2M | 9,084 | Apache-2.0 |
| Pylint pypi Python static code analyzer for detecting errors and style issues. |
60 | 12 (0.7%) | 9.1M | 5,739 | GPL-2.0-or-later |
| Pyflakes pypi Static code analyzer that checks Python for errors without executing. |
56 | 5 (0.3%) | 12M | 1,461 | MIT |
| Semgrep pypi · new in the catalog Static analysis for many languages with rules that look like code. |
54 | 3 (0.2%) | 5.3M | 17.1K | LGPL-2.1-or-later |
More in Linting and formatting: ESLint Prettier Biome oxlint oxfmt Knip stylelint ESLint Import Resolver TypeScript