Vetrix Docs

Bandit

  • Category: sast (Python)
  • Fingerprint: rule-file-surrounding-3-lines-v1
  • License: Apache-2.0
sast:
  bandit: { enabled: true }

When to enable

Any Python project. Bandit focuses on API-shape patterns (e.g. eval, shell=True, weak hash functions).

Common false positives

  • B101 (assert used) fires on every pytest assertion — Vetrix auto-scopes Bandit to exclude tests/ unless a path override says otherwise.
  • B105 (hardcoded password string) fires on string constants named PASSWORD_KEY etc.; dismiss with a scoped reason.