Home › Tool guides › Bandit and Semgrep (code scanning)

Bandit and Semgrep (code scanning)

Static analysis for Python code: Bandit finds common security issues; Semgrep runs rule packs and custom rules (for example 'no sudo() in controllers').

Official site: bandit.readthedocs.io/ · semgrep.dev/
Licence: Free (open source); Semgrep cloud plans paid

With Odoo

• Combine with pylint-odoo for Odoo-specific checks.
• Review controllers and sudo calls manually.

The full room (install, configure, use, troubleshooting, management and a hands-on checklist) is in the academy.

Open the Bandit and Semgrep (code scanning) room