All pull requests

Pull requests

• Detect requests.request() calls without a timeout in B113

  #1463·arpitjain099 opened Jul 24, 2026·

  ·

• Add cloudpickle to pickle blacklists (B403/B301)

  #1462·rayair250-droid opened Jul 23, 2026·

  ·
  1

• Detect unsafe tarfile extract calls

  #1457·0xTaoZ opened Jul 8, 2026·

  ·
  1

• Honor quiet flag for early startup log messages

  #1452·citizen204 opened Jul 5, 2026·

  ·
  1

  1

• Recognize safe extraction filters and fix member call handling in B202

  #1451·citizen204 opened Jul 5, 2026·

  ·
  1

• Detect local subclasses of Markup in B704

  #1446·ChihebBENCHEIKH1 opened Jul 1, 2026·

  ·
  1

• fix(cli): clamp severity/confidence counts to valid ranking range

  #1443·itxsamad1 opened Jun 26, 2026·

  ·
  1

• B202: detect tarfile extractall imported via a from-import

  #1442·arpitjain099 opened Jun 24, 2026·

  ·
  1

• fix(B614): lower confidence for unresolvable weights_only; add torch.jit.load regression coverage

  #1441·DevamShah opened Jun 22, 2026·

  ·
  2

• Detect empty string socket binds in B104

  #1438·Kurrisua opened Jun 15, 2026·

  ·
  1

• Add README installation guidance

  #1437·Himanshuagrawal4 opened Jun 12, 2026·

  ·
  1

• Clarify Bandit Python version guidance

  #1436·Himanshuagrawal4 opened Jun 12, 2026·

  ·
  1

  1

• fix(B104): detect empty string '' as wildcard bind address

  #1434·nilavra17ghosh opened Jun 9, 2026·

  ·
  1

  4

• Avoid full report when all files are skipped

  #1430·Himanshuagrawal4 opened Jun 1, 2026·

  ·
  1

• fix: clamp severity/confidence index to prevent IndexError (closes #1423)

  #1429·botbikamordehai2-sketch opened May 28, 2026·

  ·
  1

• Add B203: zipfile.extractall without path validation (Zip Slip / CWE-22)

  #1416·gugacyber opened May 16, 2026·

  ·
  2

• Detect empty-string wildcard host in B104 bind() calls

  #1415·mokashang opened May 13, 2026·

  ·
  1

• fix: detect unsafe tarfile.extract() in B202

  #1414·dashitongzhi opened May 12, 2026·

  ·
  1

  3

• Detect verify=False on Session/Client instance methods in B501

  #1411·jonasboos opened May 10, 2026·

  ·
  1

  4

• Detect dangerous chmod with stat module constants in B103

  #1410·jonasboos opened May 10, 2026·

  ·
  1

  5

• Detect unsafe tarfile.extract() in B202 plugin

  #1409·jonasboos opened May 10, 2026·

  ·
  1

  8

• Fix #nosec with test ID not counted in Total lines skipped

  #1408·jonasboos opened May 10, 2026·

  ·
  1

  3

• Fix B501 false negative: detect verify=False on Session/Client instances

  #1407·kimjune01 opened May 9, 2026·

  ·
  1

• Avoid UnicodeEncodeError on narrow-encoding output streams (#1251)

  #1406·DotChas opened May 2, 2026·

  ·
  1

• Fix exit code for invalid scan targets (#1326)

  #1402·soh2970 opened Apr 28, 2026·

  ·
  1