Unable to exclude directories when running the CLI
Author: mpasCreated Nov 3, 2022Updated Aug 10, 2026
Labelsbug
Describe the bug
When trying to run Bandit using the CLI and providing a ini, pyproject or yaml file for the configuration the exclude option is not working.
Reproduction steps
- Create a .bandit or pyproject.toml or bandit.yaml
- Run a scan with the created config
In all situations the exclude is not functioning.
file: .bandit
[bandit]
exclude = testsRun using bandit -r .
file: pyproject.toml
[tool.bandit]
exclude_dirs = ["tests"]Run using bandit -c pyproject.toml -r .
file: bandit.yaml
exclude_dirs: ["tests"]Run using bandit -c bandit.yaml -r .
In my case due to the use of assert statements i need to process all the tests and provide a # nosec argument.
Expected behavior
When providing a config with the exclude option i would expect that the exclude option is working. And the correct directory is ignored by Bandit for further processing.
Bandit version
1.7.4 (Default)
Python version
3.9
Additional context
See also #499
No response
Source: PyCQA/bandit