TSC Members: During the TSC call today, I brought up running bandit[0] to the flock repos. Bandit is a code scanner that looks for common security related issues in Python. It was initially an OpenStack project that has since migrated to Python Code Quality Authority. It is actively being maintained. Bandit is being used by other OpenStack projects via Tox and Zuul jobs such as Cinder and Armada[1]. There are other possible options[2] (not a comprehensive search), but they don't are either older (not maintained), python2 only or not truly opensource. If the community has other suggestions, I am welcome the additional data. The zuul job should not add too much time, since all the zuul jobs run in parallel. Currently the zuul job is no-voting, the initial scan has identified about 75 High issues. Most are dealing with subprocess being called with shell equals True, there is also a few deprecated libraries. These will need to be evaluated, it's on the schedule for the PTG. There are also options to set a baseline and use it for checking new failures. Based on the above are there any objections to continue enabling bandit for the StarlingX project's python code? Sau! [0] https://github.com/PyCQA/bandit [1] https://wiki.openstack.org/wiki/Security/Projects/Bandit [2] https://geekflare.com/find-python-security-vulnerabilities/