Bandit Integration Guide

Integrate Bandit with Vulnetix. Scan Python code for common security issues and upload SARIF results.

Install & scan

$ uv run --with 'bandit[sarif]' bandit --version
$ uv run --with 'bandit[sarif]' bandit -r . -f sarif -o bandit.sarif

Run Bandit in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run Bandit
  run: |
    pip install 'bandit[sarif]'
    bandit -r . -f sarif -o bandit.sarif

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: bandit
    path: bandit.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Bandit's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Bandit. Keep running it. Vulnetix sits on top of Bandit (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Bandit is strongest at its core category and also carries features in Secret Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Bandit does well

• Standard PyCQA Python SAST covering the full B1xx-B7xx test set: injection, subprocess/shell, insecure deserialization (pickle/yaml), weak crypto and XML attacks
• Severity + confidence scoring on every finding, letting teams tune noise and gate CI at a chosen threshold
• Highly extensible plugin architecture (test and blacklist plugins) plus per-project config, baselines and CWE mapping
• Ubiquitous in Python CI pipelines with multiple formatters (SARIF, JSON, CSV, XML, HTML)

Where Vulnetix adds to it: Vulnetix runs Python SAST natively (built-in rules + Semgrep) and ingests Bandit output as a source, deduping it into one prioritised queue. It adds the cross-cutting layer Bandit has none of: exploit-intel prioritisation, reachability, versioned VEX + audit, SSVC policy and Safe Harbour autofix, so Bandit stays the Python code linter while Vulnetix orchestrates and remediates.

No migration, no rip-and-replace. Bandit keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Bandit results in Vulnetix

Upload Bandit SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Bandit documentation ↗  ·  Source repository ↗

Wire Bandit into your CI/CD pipeline →