# Installer bandit avec Homebrew, apt, MacPorts, Nix, pacman

Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de bandit pour les workflows d'agents IA.

## installation

```sh
sudo av install brew:bandit
```

Commandes d'installation supplémentaires:

### macOS

- Homebrew (100%):

```sh
brew install bandit
```

  Preuve: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install bandit
```

  Preuve: MacPorts ports tree: python/bandit/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- Debian apt (92%):

```sh
sudo apt install bandit
```

  Preuve: Debian stable package indexes: bandit from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- Nix (92%):

```sh
nix profile install nixpkgs#bandit
```

  Preuve: nixpkgs package indexes: bandit from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix

- pacman (92%):

```sh
sudo pacman -S bandit
```

  Preuve: Arch Linux sync databases: bandit from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

## Faits du paquet

- **Clé du paquet:** brew:bandit
- **Gestionnaire de paquets:** Homebrew
- **Version:** 1.9.4
- **Résumé source:** Security-oriented static analyser for Python code
- **Page d'accueil:** <https://github.com/PyCQA/bandit>
- **Dépôt:** <https://github.com/PyCQA/bandit>
- **Généré:** 2026-08-03T19:37:03+00:00

## exécutables

- bandit (alias)
- bandit-baseline (alias)
- bandit-config-generator (alias)

## Comportement d'installation

- Bouteille: non disponible

## Version et fraîcheur

- page générée: 2026-08-03
- version du gestionnaire: 1.9.4
## Historique du projet et usages

Bandit is PyCQA's Python security linter: a command-line static analyzer that parses Python files into ASTs and runs security-focused plugins against the tree. It is one of the standard package-manager tools for lightweight Python application security checks.

### Historique du projet

The official README says Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA. Its public Git history begins in July 2014, with 0.9.0 tagged in February 2015 and a steady 1.x release line since then.

Bandit's architecture reflects the Python tooling style of its era: it uses Python's AST module, reports issue IDs such as B101 and B602, and exposes command-line, baseline, and config-generation executables for local use and CI automation.

### Historique d'adoption

Bandit's adoption broadened from OpenStack security work into the general Python quality-tooling ecosystem after it moved under PyCQA. The supplied package facts list Homebrew, Debian/Ubuntu, MacPorts, Nix, Arch, and related packaging, and the official README advertises PyPI, container images, and GitHub Actions-built images.

The project also became part of common Python CI and pre-commit workflows: the official docs include integration and CI/CD sections, and the configuration docs show usage through pre-commit with the official PyCQA repository.

### Modes d'utilisation

Bandit scans Python source recursively, builds ASTs, runs security plugins, and emits reports. Common usage is local scanning with bandit -r ., CI enforcement, baseline comparison, and per-line suppression with nosec comments when a finding has been reviewed.

Configuration can live in a .bandit INI file for recursive project scans, or in YAML/TOML files such as bandit.yaml and pyproject.toml when passed with -c. The docs also describe generated configs and plugin-specific overrides.

### Pourquoi les passionnés de paquets s'y intéressent

Bandit matters in package catalogs because it is security tooling with a tiny operational footprint: easy to add to CI, easy to vendor into developer images, and easy for distributions to expose as a CLI.

It also illustrates the consolidation of Python QA tools under PyCQA, alongside linters and format-adjacent tooling that package managers routinely provide for reproducible developer environments.

### Chronologie

- 2014: Public Git history begins in the official repository.
- 2015: 0.9.0 is tagged, followed by frequent early releases.
- 2010s: Bandit moves from the OpenStack Security Project to PyCQA, according to the official README.
- 2020s: Bandit is distributed through PyPI, OS package managers, pre-commit workflows, and signed container images.
- 2026: 1.9.x releases continue maintenance of the analyzer and rule set.

### Related projects

- Bandit is related to PyCQA tooling, Python's AST module, pre-commit, and broader Python security/static-analysis tools. It complements general-purpose linters by focusing specifically on common security issues.

### Sources

- <https://bandit.readthedocs.io/en/latest/config.html>
- <https://github.com/PyCQA/bandit>
- <https://github.com/PyCQA/bandit/blob/main/README.rst>
- <https://github.com/PyCQA/bandit/commit/c796659aea9bfb00088281bb2b6c1ef051839c18>
- input.source_facts.package-manager


## Notes de sécurité

narrow executable package without higher-risk signals.

- **Risque Geiger:** vert / faible
- narrow executable package without higher-risk signals


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: .bandit, bandit.yaml, pyproject.toml
## Autres enregistrements de gestionnaires de paquets

- Debian apt - bandit - 1.7.10-2: normalized package name match | Debian stable package indexes: bandit from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Security oriented static analyzer for Python code - Metapackage | https://github.com/PyCQA/bandit
- Debian apt - python3-bandit - 1.7.10-2: normalized package name match | Debian stable package indexes: python3-bandit from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Security oriented static analyzer for Python code - Python 3.x | https://github.com/PyCQA/bandit
- Nix - bandit: normalized package name match | nixpkgs package indexes: bandit from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix
- Ubuntu apt - bandit - 1.6.2-3: normalized package name match | Ubuntu 24.04 LTS package indexes: bandit from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Security oriented static analyzer for Python code - Metapackage | https://github.com/PyCQA/bandit
- Ubuntu apt - python3-bandit - 1.6.2-3: normalized package name match | Ubuntu 24.04 LTS package indexes: python3-bandit from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Security oriented static analyzer for Python code - Python 3.x | https://github.com/PyCQA/bandit
- pacman - bandit - 1.9.4-1: normalized package name match | Arch Linux sync databases: bandit from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Python security linter from OpenStack Security | https://github.com/PyCQA/bandit
- MacPorts - bandit: normalized package name match | MacPorts ports tree: python/bandit/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/bandit.yml](https://github.com/mxcl/pkgdb/blob/main/combined/bandit.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph