PyCQA Bandit examples/
PyCQA Bandit’s own regression corpus — one Python file per Bandit security rule.
- Upstream: https://github.com/PyCQA/bandit
- Pinned commit:
92ae8b82fb422a639f0ed8d99e96cea769594e08 - Reference: 1.9.4 release tag
- Baseline scan date: 2026-05-17
Vulnerabilities brass detects
These are the specific lines brass catches in this codebase. Re-running brass at the pinned commit reproduces each one. 23 required findings:
| File | Line | Category | Detected by | CWE / Bandit ID |
|---|---|---|---|---|
hardcoded-passwords.py | 4 | hardcoded_credential | auth_pattern_analyzer | Hardcoded Credentials (CWE-798, Bandit B105) |
hardcoded-passwords.py | 8 | hardcoded_credential | auth_pattern_analyzer | Hardcoded Credentials (CWE-798, Bandit B107) |
hardcoded-passwords.py | 38 | hardcoded_credential | auth_pattern_analyzer | Hardcoded Credentials (CWE-798, Bandit B105) |
sql_statements.py | 17 | sql_injection | input_validation_analyzer | SQL Injection via string formatting (CWE-89, Bandit B608) |
sql_statements.py | 18 | sql_injection | input_validation_analyzer | SQL Injection via string formatting (CWE-89, Bandit B608) |
sql_statements.py | 19 | sql_injection | input_validation_analyzer | SQL Injection via string formatting (CWE-89, Bandit B608) |
crypto-md5.py | 13 | weak_crypto | AstGrepScanner / bandit | Weak Hash: MD5 (CWE-327, Bandit B324) |
flask_debug.py | 10 | security_misconfiguration | bandit | Flask debug mode enabled (CWE-489, Bandit B201) |
jinja2_templating.py | 9 | xss | bandit | Jinja2 autoescape disabled (CWE-79, Bandit B701) |
requests-ssl-verify-disabled.py | 6 | insecure_transport | bandit | SSL cert verification disabled (CWE-295, Bandit B501) |
ssl-insecure-version.py | 6 | insecure_transport | bandit | Insecure TLS protocol (CWE-327, Bandit B502) |
no_host_key_verification.py | 8 | insecure_authentication | bandit | Paramiko AutoAddPolicy (CWE-295, Bandit B507) |
os-chmod.py | 6 | insecure_permissions | bandit | World-writable chmod (CWE-732, Bandit B103) |
tarfile_extractall.py | 8 | path_traversal | bandit | tarfile.extractall without filter (CWE-22, Bandit B202) |
weak_cryptographic_key_sizes.py | 5 | weak_crypto | bandit | Weak RSA/DSA key size (CWE-326, Bandit B505) |
dill.py | 6 | deserialization | bandit | Unsafe pickle/dill deserialization (CWE-502, Bandit B301) |
jsonpickle.py | 6 | deserialization | bandit | Unsafe jsonpickle deserialization (CWE-502, Bandit B301) |
eval.py | 3 | code_injection | bandit | Use of eval (CWE-95, Bandit B307) |
exec.py | 1 | code_injection | bandit | Use of exec (CWE-95, Bandit B102) |
binding.py | 4 | insecure_binding | bandit | Bind to 0.0.0.0 / all interfaces (CWE-200, Bandit B104) |
hardcoded-tmp.py | 1 | insecure_tempfile | bandit | Hardcoded /tmp path (CWE-377, Bandit B108) |
subprocess_shell.py | 11 | command_injection | bandit | subprocess Popen with shell=True (CWE-78, Bandit B602) |
assert.py | 1 | assert_in_production | bandit | assert in non-test code (CWE-617, Bandit B101) |
Documented vulnerabilities brass doesn’t yet catch
Honest list of gaps — vulnerabilities documented upstream but missed by brass’s current scanner set. We publish these so customers see the full picture, not just successes. 0 aspirational entries:
None — full upstream coverage.
Reproduce locally
git clone https://github.com/PyCQA/bandit.git project
cd project && git checkout 92ae8b82fb422a639f0ed8d99e96cea769594e08
brasscoders --offline scan .Then check .brass/detailed_analysis.yaml for the listed findings.