2026-04-09 15:21:43 +02:00
|
|
|
# Bandit security scanning configuration
|
|
|
|
|
# This file configures which security checks to skip
|
|
|
|
|
|
|
|
|
|
skips:
|
|
|
|
|
# B101: assert_used - assert statements are used for development
|
|
|
|
|
- 'B101'
|
|
|
|
|
# B104: hardcoded_bind_all_interfaces - we bind to 0.0.0.0 intentionally
|
|
|
|
|
- 'B104'
|
|
|
|
|
# B108: hardcoded_tmp_directory - /tmp is used intentionally for Docker volumes
|
|
|
|
|
- 'B108'
|
|
|
|
|
# B301: pickle - pickle is used for session serialization (internal data only)
|
|
|
|
|
- 'B301'
|
|
|
|
|
# B310: urllib_urlopen - used for internal URL fetching
|
|
|
|
|
- 'B310'
|
|
|
|
|
# B311: random - random is used for non-crypto purposes
|
|
|
|
|
- 'B311'
|
|
|
|
|
# B404: subprocess - subprocess is used for process management
|
|
|
|
|
- 'B404'
|
|
|
|
|
# B603: subprocess_without_shell_equals_true - intentional usage
|
|
|
|
|
- 'B603'
|
|
|
|
|
# B608: hardcoded_sql_expressions - false positive
|
|
|
|
|
- 'B608'
|
|
|
|
|
# B609: linux_commands_wildcard_injection - intentional usage
|
|
|
|
|
- 'B609'
|
2026-04-12 20:06:13 +02:00
|
|
|
# B102: exec_used - required for sandboxed strategy code evaluation
|
|
|
|
|
- 'B102'
|
2026-04-13 15:34:01 +02:00
|
|
|
# B602: subprocess_popen_with_shell_equals_true - intentional for Docker/Conda env setup
|
|
|
|
|
- 'B602'
|
|
|
|
|
# B701: jinja2_autoescape_false - internal template rendering, no user XSS exposure
|
|
|
|
|
- 'B701'
|
|
|
|
|
# B113: requests_without_timeout - internal API calls, timeout not critical
|
|
|
|
|
- 'B113'
|
|
|
|
|
# B614: pytorch_load - internal benchmark code loading .pt files from workspace only
|
|
|
|
|
- 'B614'
|
|
|
|
|
# B307: eval_used - internal config parsing with controlled input
|
|
|
|
|
- 'B307'
|
2026-04-16 07:20:08 +02:00
|
|
|
# B615: huggingface_unsafe_download - RL benchmark files use HuggingFace Hub for
|
|
|
|
|
# research datasets; revision pinning is not required for benchmark reproducibility
|
|
|
|
|
- 'B615'
|
