Language security linters

How to build it

1. Enable the security rule set that each ecosystem maintains for every language in use.
2. Set the severity threshold and record each accepted exception next to the code.
3. Run the same linter config in CI and in the pre-commit hook.

Signals in a repository

• A bandit configuration in pyproject.toml or .bandit with a skips list.
• An eslint config that extends the security rules from eslint-plugin-security.
• gosec or security-code-scan referenced in a CI workflow or build file.

In practice

6 repositories run a tool for this check in the scanned set.

• bandit · 6 repos

Examples

• apache/airflow · bandit

  bandit

• celery/celery · bandit

  bandit -b bandit.json -r celery/

• prowler-cloud/prowler · bandit

  bandit -q -lll -x *_test.py,./contrib/,./.venv/ -r .

• awslabs/mcp · bandit

  bandit -r --severity-level medium --confidence-level medium -f html -o bandit-report-$EXPR.html -c pyproject.toml .