Bandit

Judgement

What it is

Developer tool

What it does

Scans Python source for common security issues such as hard-coded passwords, unsafe deserialisation and shell injection.

Adopt it when

You want a free security lint step for Python code in CI.

Watch out

It checks patterns one file at a time without tracing data flow, so it misses many real issues and flags some harmless ones.

Ready for

Production-ready

Runs as

Command line

Built with

Python

How established

Established: started 8 years ago, latest release 1.9.4.

What the license allows

You can build it into a product you sell, as long as you keep its copyright notice.

Judged on 2026-11-06 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: Bandit → CPython → GCC → LLVM project → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to Bandit

1. 1
   Prettier prettier

   Prettier is an opinionated code formatter.

   Developer tool Production-ready A web team wants to stop arguing about formatting and use the formatter that nearly every editor and framework already supports.

   ★ 52k MIT JavaScript Active, pushed today
   
2. 2
   Ruff astral-sh

   An extremely fast Python linter and code formatter, written in Rust.

   Developer tool Production-ready You want to replace Flake8, isort and Black in a Python project with one tool that runs in a fraction of the time.

   ★ 50k MIT Rust Active, pushed today
   
3. 3
   Black psf

   The uncompromising Python code formatter

   Developer tool Production-ready A Python team wants formatting settled automatically and is not already using Ruff's compatible formatter.

   ★ 42k MIT Python Active, pushed yesterday
   
4. 4
   ShellCheck koalaman

   ShellCheck, a static analysis tool for shell scripts

   Developer tool Production-ready Your repositories contain shell scripts, especially in CI or deployment, and you want common mistakes caught before they run.

   ★ 40k GPL-3.0 Haskell Active, pushed today
5. 5
   ESLint eslint

   Find and fix problems in your JavaScript code.

   Developer tool Production-ready You need the JavaScript linter with the largest rule and plugin ecosystem, including framework-specific rules for React, Vue and others.

   ★ 28k MIT JavaScript Active, pushed today
   
6. 6
   Biome biomejs

   A toolchain for web projects, aimed to provide functionalities to maintain them. Biome offers formatter and linter, usable via CLI and LSP.

   Developer tool Production-ready You want to replace ESLint plus Prettier in a web project with a single fast tool and can live with its built-in rule set.

   ★ 26k Apache-2.0 Rust Active, pushed today
   
7. 7
   Oxc oxc-project

   ⚓ A collection of high-performance JavaScript tools.

   Developer tool Usable Linting is slow on a large JavaScript codebase and you want Oxlint alongside or instead of ESLint, or you build tooling that needs a fast parser.

   ★ 23k MIT Rust Active, pushed today
   
8. 8
   mypy python

   Optional static typing for Python

   Developer tool Production-ready A growing Python codebase uses type hints and you want the reference checker that most typing features land in first.

   ★ 21k See repository Python Active, pushed today