What happens when Bandit findings are not reviewed before a pull request is merged?

Why This Matters for Security Teams

Bandit is useful because it catches insecure Python patterns before they become part of the software baseline. When findings are not reviewed before merge, the issue is no longer just a code smell, it becomes an accepted control gap in the main branch. That changes the risk profile from local developer feedback to organisation-wide exposure in CI/CD, release, and runtime environments.

The real failure is usually not that Bandit found too much, but that teams treat scan output as advisory rather than part of the merge decision. Findings around weak crypto, unsafe deserialisation, shell invocation, or hardcoded secrets often look minor in isolation, yet they can create exploit paths when combined with other flaws. A disciplined review process also helps separate true positives from acceptable exceptions, which matters because unmanaged false positives eventually train developers to ignore all scanner output.

For a broader control lens, the NIST Cybersecurity Framework 2.0 is relevant because it frames how organisations manage secure development and risk treatment as operational discipline, not as a one-time scan result. In practice, many security teams encounter insecure Python only after the code has already shipped, rather than through intentional pre-merge review.

How It Works in Practice

In a mature workflow, Bandit runs inside pull request checks and produces results that are easy to interpret alongside the diff. Teams typically triage findings into three buckets: fix immediately, accept with justification, or confirm as a false positive. The important point is that the merge decision should be tied to the review outcome, not just the scan completion status.

• Critical or high-risk findings should block the pull request until corrected.
• Lower-risk findings may be allowed only with documented rationale and owner approval.
• False positives should be dismissed with enough context that the same issue is not repeatedly reopened.
• Security exceptions should expire, so temporary acceptance does not become permanent drift.

This works best when the scanner output is unified with other code quality signals and reviewed in the same developer workflow. That reduces the chance that security issues are hidden in a separate dashboard no one opens. It also creates a clear audit trail for governance, which matters when teams need to show why a risky pattern was accepted or remediated.

Operationally, the strongest pattern is to map Bandit severity to merge policy, then reserve manual review for edge cases and business exceptions. Where possible, teams should pair the scan with secure coding guidance so developers learn why a pattern is unsafe, not just that it failed a gate. For background on governance and risk management concepts that support this model, the NIST CSF discussion above is a useful anchor.

These controls tend to break down in fast-moving repositories with many maintainers because pull request ownership becomes unclear and security decisions get deferred until after release.

Common Variations and Edge Cases

Tighter merge blocking often increases developer friction, requiring organisations to balance release speed against the cost of letting insecure code accumulate. That tradeoff is real, especially in product teams that ship frequently and cannot afford lengthy manual review queues.

Not every Bandit finding should be treated the same way. Some rules are context-sensitive, and current guidance suggests that exceptions should be documented where the code path is provably safe or the pattern is unavoidable. There is no universal standard for tuning severity across every Python codebase, so teams usually calibrate based on data sensitivity, exposure, and downstream privilege.

Edge cases also appear in generated code, legacy modules, and test fixtures. A finding in a test file may not carry the same production risk as one in an API handler, but ignoring it without classification weakens the review discipline. The same is true for third-party code: if the repository vendorises dependencies, teams should decide whether those paths are scanned, exempted, or isolated from merge gates.

Where Bandit is most helpful is not in forcing perfect code, but in making risk explicit before merge. If the process only records findings after deployment, the team loses the main advantage of static analysis, which is to prevent avoidable security debt from entering the branch in the first place.

Related resources from NHI Mgmt Group

• What breaks when code verification only happens in CI or pull request review?
• Should organisations allow pull_request_target for automated dependency workflows?
• How should security teams structure crisis decision rights before an incident happens?
• What should organisations do before DSPM findings become board material?