Ruff's S rule set is equivalent to Bandit security checks. CodeRabbit already runs ruff, but CI proper doesn't include the security rules.
Add to the lint job:
- name: Security lint
run: ruff check --select S vera/
Review findings and add # noqa: S... for legitimate exceptions (e.g., subprocess usage in tests). This catches common Python security anti-patterns like hardcoded credentials, use of eval, and insecure temp file creation.
Ruff's
Srule set is equivalent to Bandit security checks. CodeRabbit already runs ruff, but CI proper doesn't include the security rules.Add to the lint job:
Review findings and add
# noqa: S...for legitimate exceptions (e.g.,subprocessusage in tests). This catches common Python security anti-patterns like hardcoded credentials, use ofeval, and insecure temp file creation.