.bandit.yml

# Bandit configuration file for Animation Workbench security scanning
# https://bandit.readthedocs.io/en/latest/config.html

exclude_dirs:
  - ./test
  - ./test/**
  - animation_workbench/test

# Skip acceptable issues for this QGIS plugin:
skips:
  # B101: assert statements - legitimate in tests
  - B101
  # B104: Binding to 0.0.0.0 - intentional for debug server (development only)
  - B104
  # B108: Hardcoded /tmp - acceptable for temporary file handling
  - B108
  # B110: Try/except/pass - acceptable for silent error handling in UI code
  - B110
  # B404: subprocess import - required for ffmpeg/imagemagick integration
  - B404
  # B603: subprocess without shell=True - this is the SECURE way to call processes
  - B603
  # B606: Process without shell - this is intentional and secure
  - B606
  # B607: Partial path - acceptable when calling known system tools (ffmpeg, convert)
  - B607

# Note: High severity issues that MUST remain fixed:
# - B605: Shell injection - fixed by using glob/os.remove instead of os.system
# - B602: Shell injection via subprocess shell=True - not used