bandit -b: Baseline to Ignore Existing Issues
bandit -b <baseline.json> reports only issues not already present in the baseline, so legacy findings do not block new work.
Turning Bandit on for an existing project surfaces a wall of findings. A baseline records the current set so the gate only triggers on issues your change introduces.
What it does
You generate a JSON report once, then pass it with -b on later runs. Bandit subtracts the baselined issues and only exits 1 on new ones. The baseline must be JSON format (-f json). Inline # nosec (optionally # nosec B602) suppresses individual lines.
Common usage
# 1. create the baseline
bandit -r ./src -f json -o bandit-baseline.json
# 2. later runs only fail on NEW issues
bandit -r ./src -b bandit-baseline.jsonOptions
| Flag | What it does |
|---|---|
| -f json -o <file> | Write a JSON report to seed the baseline |
| -b, --baseline <file> | Ignore issues already in this JSON baseline |
| # nosec | Inline comment to skip a finding on that line |
| # nosec B602 | Skip only a specific check on that line |
In CI
Commit the baseline JSON and regenerate it deliberately after fixing or accepting issues, not to bury them. Bandit baselines match on issue content and location, so large refactors can shift line numbers and resurface old findings as new; refresh the baseline after such changes.
Common errors in CI
"could not open baseline" means the JSON file is missing from the workspace. "Baseline must be in JSON format" means you saved it with the default screen format; regenerate with -f json. New findings that are actually old usually mean a refactor moved code, changing the line numbers Bandit keys on.