# Bandit Security Scanner Configuration
# Documentation: https://bandit.readthedocs.io/

title: Bandit Security Scan for NexQuant

# Tests to skip (known false positives or acceptable risks)
skips:
  - B101  # assert_used (asserts are OK in non-production code)
  - B602  # subprocess_popen_with_shell_equals_true (known issue, will fix separately)
  - B701  # jinja2_autoescape_false (false positive - code templates, not HTML)
  - B301  # pickle (known usage for internal data, will audit separately)
  - B108  # hardcoded_tmp_directory (internal tool)
  - B615  # huggingface_unsafe_download (will audit separately)
  - B307  # eval usage (will audit separately)
  - B614  # pytorch_load (internal benchmark code)
  - B104  # hardcoded_bind_all_interfaces (internal tool, localhost only)
  - B310  # urllib_urlopen (internal API calls)

# Minimum severity to report (LOW, MEDIUM, HIGH)
# Pre-commit only warns on MEDIUM, blocks on HIGH
severity_level: HIGH

# Minimum confidence level (LOW, MEDIUM, HIGH)
confidence_level: MEDIUM