add bandit security tests

Bandit finds a couple issues (see `tox -e bandit` for the report). Those should be addressed separately. Once everything is passing, we can add it to the Github Actions workflow.
appsembler · Jan 18, 2022 · ef4d34f · ef4d34f
1 parent 3975f5a
commit ef4d34f
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/bandit.yaml b/bandit.yaml
@@ -0,0 +1,2 @@
+exclude_dirs:
+  - '/tests/'
diff --git a/tox.ini b/tox.ini
@@ -73,4 +73,10 @@ basepython=python2
 deps =
 	-r{toxinidir}/devsite/requirements/hawthorn.txt
 commands =
-	edx_lint write pylintrc
+	edx_lint write pylintrc
+
+[testenv:bandit]
+deps =
+    bandit==1.7.1
+commands =
+    bandit -c bandit.yaml -r figures