Flock Folks, Sorry I missed the Flock meeting this morning, I would like to discuss this in the community meeting if we have time. We are working to add bandit[0] (the python static scanner), running it over all python. Sharath is starting with adding a general zuul project template [1] that will be available to all StarlingX repos. An example of it's usage is in fault [2]. As Al pointed out in the initial (now abandoned) config review, we are running bandit in sysinv. I would like to know what the history of having tox.ini in the lower directories is. As we want to run bandit on all the python code in config and other repos. Is this something we can undo and move up? Also, are we tracking someplace when we move something to the skip category? I see that most of the High issues are currently being skipped. If we are skipping known issues, can we use the baseline feature somehow to catch potential new issues? Thanks Sau! [0] https://github.com/PyCQA/bandit [1] https://review.opendev.org/#/c/721294/ [2] https://review.opendev.org/#/c/721307/