bandit VS pre-commit-hooks

Bandit is a tool designed to find common security issues in Python code. It was developed by the OpenStack Security Project and is a great addition to any serious Python project.

For the SAST stage, I used SonarQube tool. SonarQube is an open-source platform developed by SonarSource for continuous inspection of code quality to perform automatic reviews with static analysis of code to detect bugs and code smells on more than 30 programming languages. I preferred SonarQube instead of other SAST tools because it has a detailed documentation and plugins about integration with Jenkins and SonarQube works with Java projects pretty well. Of course you can similar multi-language-supported tools such as Semgrep or language-specific tools such as Bandit.

On the other hand, Bandit is a dedicated security scanner designed to target critical security concerns such as SQL injection and cross-site scripting exploits. It meticulously scrutinizes the codebase to identify and alert developers about possible security breaches or vulnerabilities, thus fortifying the code against potential exploitation.

Bandit: is a tool designed for Python applications to analyse your code for potential security issues like insecure use of functions, hardcoded password and much more.

Bandit (for Python, open-source and free)

Add security checks (Bandit) and dependency checks (safety)

bandit

flake8-bandit which uses bandit for security linting.

If the risk is higher than normal, they could run a static code analysis tool like bandit, that includes checks for bad practices. While I think you should be able to code whatever/however you want to, it could lower your score if you looped through all env-variables. Maybe. Then display that indicator on pypi.

# See https://pre-commit.com for more information # See https://pre-commit.com/hooks.html for more hooks repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: v3.2.0 hooks: - id: trailing-whitespace - id: end-of-file-fixer - id: check-yaml - id: check-toml - id: check-added-large-files - repo: local hooks: - id: tox lint name: tox-validation entry: pdm run tox -e test,lint language: system files: ^src\/.+py$|pyproject.toml|^tests\/.+py$ types_or: [python, toml] pass_filenames: false - id: tox docs name: tox-docs language: system entry: pdm run tox -e docs types_or: [python, rst, toml] files: ^src\/.+py$|pyproject.toml|^docs\/ pass_filenames: false - repo: https://github.com/pdm-project/pdm rev: 2.10.4 # a PDM release exposing the hook hooks: - id: pdm-lock-check - repo: https://github.com/jumanjihouse/pre-commit-hooks rev: 3.0.0 hooks: - id: markdownlint

repos: - repo: https://github.com/ambv/black rev: 23.3.0 hooks: - id: black args: [--config=./pyproject.toml] language_version: python3.11 - repo: https://github.com/pycqa/flake8 rev: 6.0.0 hooks: - id: flake8 args: [--config=./tox.ini] language_version: python3.11 - repo: https://github.com/pycqa/isort rev: 5.12.0 hooks: - id: isort args: ["--profile", "black", "--filter-files"] language_version: python3.11 - repo: https://github.com/pre-commit/pre-commit-hooks rev: v4.4.0 hooks: - id: requirements-txt-fixer language_version: python3.11 - id: debug-statements - id: detect-aws-credentials - id: detect-private-key

repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: hooks: - id: check-json

$ pre-commit run --all-files [INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks. [INFO] Initializing environment for https://github.com/psf/black. [INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks. [INFO] Once installed this environment will be reused. [INFO] This may take a few minutes... [INFO] Installing environment for https://github.com/psf/black. [INFO] Once installed this environment will be reused. [INFO] This may take a few minutes... Check Yaml...............................................................Passed Fix End of Files.........................................................Passed Trim Trailing Whitespace.................................................Failed - hook id: trailing-whitespace - exit code: 1 Files were modified by this hook. Additional output: Fixing sample.py black....................................................................Passed

The excellent pre-commit framework (https://pre-commit.com/) has a hook for that in its official hook collection: https://github.com/pre-commit/pre-commit-hooks#detect-aws-cr...

exclude: .*migrations\/.* repos: - repo: https://github.com/pre-commit/pre-commit-hooks ... - repo: https://github.com/psf/black rev: 22.12.0 hooks: - id: black language_version: python3.9

This is what we use — https://github.com/pre-commit/pre-commit-hooks/blob/main/pre_commit_hooks/detect_private_key.py

repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: v3.3.0 hooks: - id: check-yaml args: ["--allow-multiple-documents"] - repo: local hooks: - id: forbidden-files name: forbidden files entry: found copier update rejection files; review them and remove them language: fail files: "\\.rej$" - id: black name: black entry: poetry run black language: system types: [python] - id: flake8 name: flake8 entry: poetry run flake8 language: system types: [python] - id: isort name: isort entry: poetry run isort --settings-path=. language: system types: [python] - id: pyupgrade name: pyupgrade entry: poetry run pyupgrade language: system types: [python] args: [--py310-plus] - id: mypy name: mypy description: Check python types. entry: poetry run mypy language: system types: [python]

# See https://pre-commit.com for more information # See https://pre-commit.com/hooks.html for more hooks repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: v4.0.1 hooks: - id: check-toml - id: check-yaml - id: end-of-file-fixer - id: mixed-line-ending - repo: https://github.com/psf/black rev: 22.3.0 hooks: - id: black args: ["--check"] - repo: https://github.com/PyCQA/isort rev: 5.10.1 hooks: - id: isort args: ["--check", "--profile", "black"] - repo: https://github.com/PyCQA/flake8 rev: 4.0.1 hooks: - id: flake8 additional_dependencies: [mccabe] args: ["--max-line-length", "88", "--max-complexity", "10"] - repo: https://github.com/PyCQA/pylint/ rev: v2.14.5 hooks: - id: pylint exclude: tests/ # Prevent files in tests/ to be passed in to pylint.

I usually use [pre-commit](https://pre-commit.com/) with my repos, but I don't know what common tools I should use for golang apart from the built in [pre-commit hooks](https://github.com/pre-commit/pre-commit-hooks). Has anyone got any suggestions? Perhaps a github link so I can see the various things. How do you run gofmt through it? Thank you. :)