📘 Security Testing: Bandit and Safety

🎯 Introduction

Welcome to this exciting tutorial on security testing with Bandit and Safety! 🎉 In this guide, we’ll explore how to protect your Python applications from vulnerabilities and security risks.

You’ll discover how automated security testing can transform your development process. Whether you’re building web applications 🌐, APIs 🔌, or command-line tools 🖥️, understanding security testing is essential for writing safe, trustworthy code.

By the end of this tutorial, you’ll feel confident using Bandit and Safety to scan your code for security issues! Let’s dive in! 🏊‍♂️

📚 Understanding Security Testing

🤔 What is Security Testing?

Security testing is like having a security guard 👮 for your code. Think of it as a thorough inspection that checks every corner of your application for potential vulnerabilities that hackers might exploit.

In Python terms, security testing tools analyze your code to find:

🚪 Backdoors and security holes
🔓 Weak authentication patterns
💉 SQL injection vulnerabilities
🛡️ Hardcoded secrets and passwords

💡 Why Use Bandit and Safety?

Here’s why developers love these tools:

Automated Scanning 🤖: Find vulnerabilities without manual review
Early Detection 🚨: Catch security issues before production
Best Practices 📖: Learn secure coding patterns
CI/CD Integration 🔄: Automate security checks in your pipeline

Real-world example: Imagine building a banking app 🏦. With Bandit and Safety, you can automatically detect if you accidentally commit API keys or use insecure random number generation!

🔧 Basic Syntax and Usage

📝 Installing the Tools

Let’s start by installing our security testing tools:

# 🚀 Install Bandit for code scanning
pip install bandit

# 🛡️ Install Safety for dependency checking
pip install safety

# 🎯 Or install both at once!
pip install bandit safety

💡 Explanation: Bandit scans your Python code for security issues, while Safety checks your installed packages for known vulnerabilities!

🎯 Running Your First Security Scan

Here’s how to use these tools:

# 🔍 Scan a single file with Bandit
bandit example.py

# 📁 Scan an entire project
bandit -r ./my_project/

# 🛡️ Check dependencies with Safety
safety check

# 📊 Generate detailed reports
bandit -r ./my_project/ -f json -o security_report.json

💡 Practical Examples

🚨 Example 1: Detecting Common Vulnerabilities

Let’s create a file with security issues and scan it:

# vulnerable_code.py - DON'T use this in production! 🚫

import pickle
import subprocess
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

# ❌ Hardcoded password (B105)
PASSWORD = "super_secret_123"  # 🚨 Never do this!

# ❌ Using pickle with untrusted data (B301)
def load_user_data(data):
    return pickle.loads(data)  # 💥 Dangerous!

# ❌ Shell injection vulnerability (B602)
def run_command(user_input):
    subprocess.call(user_input, shell=True)  # 😱 Security risk!

# ❌ Weak cryptography (B304)
def weak_random():
    import random
    return random.random()  # 🎲 Not cryptographically secure!

# ✅ Let's scan this file!
# Run: bandit vulnerable_code.py

🎯 Bandit Output:

>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: 'super_secret_123'
   Severity: Low   Confidence: Medium
   Location: vulnerable_code.py:7

>> Issue: [B301:blacklist] Pickle library used - potential security risk
   Severity: Medium   Confidence: High
   Location: vulnerable_code.py:11

>> Issue: [B602:subprocess_popen_with_shell_equals_true] Risk of shell injection
   Severity: High   Confidence: High
   Location: vulnerable_code.py:15

🛡️ Example 2: Secure Code Patterns

Now let’s write secure versions:

# secure_code.py - The RIGHT way! ✅

import os
import json
import subprocess
import secrets
from cryptography.fernet import Fernet

# ✅ Use environment variables for secrets
PASSWORD = os.environ.get('APP_PASSWORD')  # 🔐 Much better!

# ✅ Use JSON instead of pickle
def load_user_data(data):
    return json.loads(data)  # 🎯 Safe parsing!

# ✅ Avoid shell=True, validate input
def run_command(command_list):
    # 🛡️ Only allow specific commands
    allowed_commands = ['ls', 'pwd', 'echo']
    if command_list[0] in allowed_commands:
        subprocess.run(command_list, shell=False)  # ✨ Secure!

# ✅ Use cryptographically secure random
def secure_random():
    return secrets.token_hex(16)  # 🔒 Cryptographically strong!

# ✅ Proper encryption
def encrypt_data(data):
    key = Fernet.generate_key()  # 🗝️ Generate secure key
    f = Fernet(key)
    encrypted = f.encrypt(data.encode())  # 🔐 Encrypted!
    return key, encrypted

🏦 Example 3: Real-World Security Scanning

Let’s create a complete security testing workflow:

# security_scanner.py - Automated security testing! 🚀

import subprocess
import json
import sys
from datetime import datetime

class SecurityScanner:
    def __init__(self, project_path):
        self.project_path = project_path
        self.results = {
            'scan_date': datetime.now().isoformat(),
            'bandit_issues': [],
            'safety_issues': []
        }
    
    # 🔍 Run Bandit scan
    def scan_code(self):
        print("🔍 Running Bandit security scan...")
        try:
            # 🎯 Run Bandit and capture output
            result = subprocess.run(
                ['bandit', '-r', self.project_path, '-f', 'json'],
                capture_output=True,
                text=True
            )
            
            if result.stdout:
                bandit_results = json.loads(result.stdout)
                self.results['bandit_issues'] = bandit_results.get('results', [])
                print(f"✅ Found {len(self.results['bandit_issues'])} issues")
            
        except Exception as e:
            print(f"❌ Bandit scan failed: {e}")
    
    # 🛡️ Check dependencies
    def check_dependencies(self):
        print("🛡️ Checking dependencies with Safety...")
        try:
            # 📦 Run Safety check
            result = subprocess.run(
                ['safety', 'check', '--json'],
                capture_output=True,
                text=True
            )
            
            if result.stdout:
                safety_results = json.loads(result.stdout)
                self.results['safety_issues'] = safety_results
                print(f"✅ Found {len(safety_results)} vulnerable packages")
                
        except Exception as e:
            print(f"❌ Safety check failed: {e}")
    
    # 📊 Generate report
    def generate_report(self):
        print("\n📊 Security Report Summary:")
        print("=" * 50)
        
        # 🚨 Bandit issues by severity
        severity_count = {'High': 0, 'Medium': 0, 'Low': 0}
        for issue in self.results['bandit_issues']:
            severity_count[issue['issue_severity']] += 1
        
        print("\n🔍 Code Security Issues:")
        for severity, count in severity_count.items():
            emoji = "🔴" if severity == "High" else "🟡" if severity == "Medium" else "🟢"
            print(f"  {emoji} {severity}: {count} issues")
        
        # 📦 Vulnerable dependencies
        print(f"\n🛡️ Vulnerable Dependencies: {len(self.results['safety_issues'])}")
        
        # 💾 Save detailed report
        with open('security_report.json', 'w') as f:
            json.dump(self.results, f, indent=2)
        print("\n✅ Detailed report saved to security_report.json")
        
        # 🎯 Exit with error if high severity issues
        if severity_count['High'] > 0:
            print("\n❌ High severity issues found! Fix before deploying!")
            sys.exit(1)

# 🎮 Let's use it!
if __name__ == "__main__":
    scanner = SecurityScanner("./my_project")
    scanner.scan_code()
    scanner.check_dependencies()
    scanner.generate_report()

🚀 Advanced Concepts

🧙‍♂️ Custom Bandit Configuration

When you’re ready to level up, create custom security profiles:

# .bandit configuration file
# 🎯 Customize your security scanning!

[bandit]
# 🚫 Exclude test files
exclude: /test,/tests

# 🎯 Only check for high severity issues
severity: high

# 📋 Custom test selection
tests: B201,B301,B302,B303,B304,B305,B306

# 🛡️ Skip specific lines with comments
# Example: # nosec - tells Bandit to skip this line

🏗️ CI/CD Integration

Integrate security testing into your pipeline:

# .github/workflows/security.yml
# 🚀 Automated security testing!

name: Security Tests 🛡️

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      
      - name: Set up Python 🐍
        uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      
      - name: Install dependencies 📦
        run: |
          pip install bandit safety
          pip install -r requirements.txt
      
      - name: Run Bandit 🔍
        run: bandit -r . -f json -o bandit-report.json
      
      - name: Check dependencies 🛡️
        run: safety check --json > safety-report.json
      
      - name: Upload reports 📊
        uses: actions/upload-artifact@v2
        with:
          name: security-reports
          path: |
            bandit-report.json
            safety-report.json

⚠️ Common Pitfalls and Solutions

😱 Pitfall 1: Ignoring Low Severity Issues

# ❌ Wrong approach - ignoring "low" severity
def get_user():
    # B104: Low severity - but still important!
    host = "0.0.0.0"  # 🚨 Binds to all interfaces!
    return host

# ✅ Correct approach - fix all issues
def get_user():
    # 🔒 Bind to specific interface
    host = "127.0.0.1"  # ✅ Much more secure!
    return host

🤯 Pitfall 2: False Positives

# ❌ Bandit might flag this incorrectly
password_field_name = "password"  # 🚨 False positive!

# ✅ Use inline comments to suppress false positives
password_field_name = "password"  # nosec - just a field name

# 🎯 Or use more specific variable names
form_field_for_password = "password"  # ✅ Clearer intent

🛠️ Best Practices

🎯 Regular Scanning: Run security tests on every commit
📊 Track Metrics: Monitor security issues over time
🛡️ Update Dependencies: Keep packages current
🎨 Security First: Design with security in mind
✨ Education: Learn from the issues found

🧪 Hands-On Exercise

🎯 Challenge: Secure a Web Application

Create a security testing suite for a Flask application:

📋 Requirements:

✅ Scan all Python files for security issues
🛡️ Check all dependencies for vulnerabilities
📊 Generate a comprehensive security report
🚨 Fail the build if critical issues are found
🎨 Create a security dashboard!

🚀 Bonus Points:

Integrate with pre-commit hooks
Add custom security rules
Create automated fixes for common issues

💡 Solution

🔍 Click to see solution

# security_suite.py - Complete security testing suite! 🚀

import os
import json
import subprocess
from datetime import datetime
from pathlib import Path
import matplotlib.pyplot as plt

class SecurityTestSuite:
    def __init__(self, project_root):
        self.project_root = Path(project_root)
        self.report = {
            'timestamp': datetime.now().isoformat(),
            'project': str(self.project_root),
            'summary': {},
            'details': {}
        }
    
    # 🔍 Comprehensive code scan
    def scan_code_security(self):
        print("🔍 Starting comprehensive security scan...")
        
        # 🎯 Run Bandit with detailed output
        bandit_cmd = [
            'bandit', '-r', str(self.project_root),
            '-f', 'json', '--severity-level', 'low'
        ]
        
        result = subprocess.run(bandit_cmd, capture_output=True, text=True)
        
        if result.stdout:
            bandit_data = json.loads(result.stdout)
            
            # 📊 Process results
            issues_by_severity = {'High': [], 'Medium': [], 'Low': []}
            
            for issue in bandit_data.get('results', []):
                severity = issue['issue_severity']
                issues_by_severity[severity].append({
                    'file': issue['filename'],
                    'line': issue['line_number'],
                    'issue': issue['issue_text'],
                    'confidence': issue['issue_confidence']
                })
            
            self.report['details']['code_scan'] = issues_by_severity
            self.report['summary']['total_code_issues'] = len(bandit_data.get('results', []))
            
            # 🎨 Print colorful summary
            print(f"\n📊 Code Security Summary:")
            print(f"  🔴 High: {len(issues_by_severity['High'])}")
            print(f"  🟡 Medium: {len(issues_by_severity['Medium'])}")
            print(f"  🟢 Low: {len(issues_by_severity['Low'])}")
    
    # 🛡️ Check dependencies
    def check_dependencies(self):
        print("\n🛡️ Checking dependency vulnerabilities...")
        
        safety_cmd = ['safety', 'check', '--json']
        result = subprocess.run(safety_cmd, capture_output=True, text=True)
        
        vulnerabilities = []
        if result.stdout:
            try:
                safety_data = json.loads(result.stdout)
                vulnerabilities = safety_data
            except:
                # 📝 Parse non-JSON output
                vulnerabilities = []
        
        self.report['details']['dependencies'] = vulnerabilities
        self.report['summary']['vulnerable_packages'] = len(vulnerabilities)
        
        print(f"  📦 Found {len(vulnerabilities)} vulnerable packages")
    
    # 🔐 Check for secrets
    def scan_for_secrets(self):
        print("\n🔐 Scanning for hardcoded secrets...")
        
        # 🎯 Common patterns to check
        secret_patterns = [
            r'api[_-]?key\s*=\s*["\'][^"\']+["\']',
            r'password\s*=\s*["\'][^"\']+["\']',
            r'secret\s*=\s*["\'][^"\']+["\']',
            r'token\s*=\s*["\'][^"\']+["\']'
        ]
        
        secrets_found = []
        
        # 🔍 Search through Python files
        for py_file in self.project_root.rglob('*.py'):
            if '.venv' in str(py_file) or '__pycache__' in str(py_file):
                continue
                
            try:
                content = py_file.read_text()
                for line_no, line in enumerate(content.splitlines(), 1):
                    for pattern in secret_patterns:
                        if any(word in line.lower() for word in ['password', 'secret', 'key', 'token']):
                            if '=' in line and not 'environ' in line:
                                secrets_found.append({
                                    'file': str(py_file),
                                    'line': line_no,
                                    'content': line.strip()[:50] + '...'
                                })
            except:
                pass
        
        self.report['details']['secrets'] = secrets_found
        self.report['summary']['hardcoded_secrets'] = len(secrets_found)
        
        print(f"  🔑 Found {len(secrets_found)} potential secrets")
    
    # 📊 Generate visual report
    def generate_dashboard(self):
        print("\n📊 Generating security dashboard...")
        
        # 🎨 Create pie chart of issues
        fig, (ax1, ax2) = plt.subplots(1, 2, figsize=(12, 5))
        
        # 📊 Code issues by severity
        code_issues = self.report['details']['code_scan']
        severities = ['High', 'Medium', 'Low']
        counts = [len(code_issues[s]) for s in severities]
        colors = ['#ff4444', '#ffaa00', '#44ff44']
        
        ax1.pie(counts, labels=severities, colors=colors, autopct='%1.1f%%')
        ax1.set_title('🔍 Code Issues by Severity')
        
        # 📊 Overall security score
        total_issues = sum(counts)
        score = max(0, 100 - (total_issues * 5))  # 5 points per issue
        
        ax2.bar(['Security Score'], [score], color='#4CAF50' if score >= 80 else '#FF9800')
        ax2.set_ylim(0, 100)
        ax2.set_ylabel('Score')
        ax2.set_title(f'🛡️ Security Score: {score}/100')
        
        plt.tight_layout()
        plt.savefig('security_dashboard.png')
        print("  ✅ Dashboard saved to security_dashboard.png")
    
    # 🚀 Run complete suite
    def run_full_scan(self):
        print("🚀 Running complete security test suite...\n")
        
        self.scan_code_security()
        self.check_dependencies()
        self.scan_for_secrets()
        self.generate_dashboard()
        
        # 💾 Save full report
        with open('security_report.json', 'w') as f:
            json.dump(self.report, f, indent=2)
        
        print("\n✅ Security scan complete!")
        print(f"📄 Full report: security_report.json")
        print(f"📊 Dashboard: security_dashboard.png")
        
        # 🚨 Exit with error if critical issues
        if self.report['summary'].get('total_code_issues', 0) > 0:
            high_issues = len(self.report['details']['code_scan']['High'])
            if high_issues > 0:
                print(f"\n❌ {high_issues} HIGH severity issues found!")
                return False
        
        print("\n✅ All security checks passed! 🎉")
        return True

# 🎮 Test it out!
if __name__ == "__main__":
    suite = SecurityTestSuite(".")
    success = suite.run_full_scan()
    
    if not success:
        exit(1)  # 🚨 Fail the build

🎓 Key Takeaways

You’ve learned so much about security testing! Here’s what you can now do:

✅ Use Bandit to scan code for vulnerabilities 🔍
✅ Use Safety to check dependencies 🛡️
✅ Integrate security into your CI/CD pipeline 🔄
✅ Write secure code following best practices 🔒
✅ Build security into your development process! 🚀

Remember: Security isn’t a feature, it’s a requirement! Make it part of your daily workflow. 🤝

🤝 Next Steps

Congratulations! 🎉 You’ve mastered security testing with Bandit and Safety!

Here’s what to do next:

💻 Run security scans on your existing projects
🏗️ Set up automated security testing in CI/CD
📚 Learn about OWASP Top 10 vulnerabilities
🌟 Share security knowledge with your team!

Remember: Every secure application starts with a developer who cares about security. Keep scanning, keep learning, and most importantly, keep your code safe! 🚀

Happy secure coding! 🎉🚀✨

Prerequisites

What you'll learn