# Share a Bandit Report — Python Security Findings Someone Will Triage

Canonical: https://commareports.com/share-bandit-report
Published: 2026-08-25

> bandit -f html writes a findings file that dies in the CI job. Publish it to Comma as a private report: one link for the reviewers, a thread per finding, and a revision per run.

# Share a Bandit report

Bandit finds the `subprocess` call with `shell=True`, the hardcoded
password in a test fixture, the `yaml.load` that should be
`safe_load` — and then writes its findings into a job that expires.

```bash
bandit -r . -f html -o bandit.html
```

One self-contained file: severity, confidence, CWE, and the source lines
around each hit. No assets folder, nothing to serve.

## Publish it privately

```bash
curl -X POST https://commareports.com/api/v1/reports \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html bandit.html \
        '{title: "Bandit — api service", html: $html, visibility: "private"}')"
```

Note the `private`. Visibility is set at create time — `private`,
`registered` or `public` — and a scanner report is the case where you
choose it deliberately rather than fixing it later. It is a map of where
the weak code is.

Then add the people who need it: named reviewers, your team, or a domain
gate. See [sharing & access control](/docs/sharing).

## Triage is the actual work

On any real codebase most findings are contextually fine and a few are
not, and telling them apart takes someone who knows the code. That's a
conversation, and it needs to happen somewhere the finding is visible:

- **Anchored threads** per finding — "validated upstream, marking
  `# nosec` with a reason" — see [commenting on
  HTML](/comment-on-html).
- **Revisions**, so the next scan shows what was fixed, what was
  accepted, and what's new.
- **A record**, which is the thing an auditor asks for and a CI log
  can't produce.

## From CI

```bash
bandit -r . -f html -o bandit.html || true   # bandit exits non-zero on findings

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html bandit.html \
        --arg title "Bandit — $GITHUB_SHA" '{title: $title, html: $html}')"
```

Bandit exits non-zero when it finds something, so guard the step or the
publish never runs on exactly the builds worth publishing. More in
[publishing from CI](/docs/ci).

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files
  total.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Publish a scan report →](https://commareports.com/)**

### Related

- [Share a security scan report](/share-security-scan-report) · [Share a Trivy report](/share-trivy-report)
- [Share an OWASP ZAP report](/share-zap-report) · [Share an npm audit report](/share-npm-audit-report)
- [Share an ESLint report](/share-eslint-report) · [Publish from CI](/docs/ci)