diff --git a/bandit.yaml b/bandit.yaml
new file mode 100644
index 00000000..17285460
--- /dev/null
+++ b/bandit.yaml
@@ -0,0 +1,2 @@
+exclude_dirs:
+  - '/tests/'
diff --git a/tox.ini b/tox.ini
index 405aae5f..498a81fc 100644
--- a/tox.ini
+++ b/tox.ini
@@ -73,4 +73,10 @@ basepython=python2
 deps =
 	-r{toxinidir}/devsite/requirements/hawthorn.txt
 commands =
-	edx_lint write pylintrc
\ No newline at end of file
+	edx_lint write pylintrc
+
+[testenv:bandit]
+deps =
+    bandit==1.7.1
+commands =
+    bandit -c bandit.yaml -r figures