Is there a config option to only report High confidence and High Severity Issues?

[Contino-AT]

In documentation, I can't see any option to report only High confidence and High Severity Issues in config file - https://bandit.readthedocs.io/en/latest/config.html. However, I do see that github actions input have severity and confidence -https://bandit.readthedocs.io/en/latest/ci-cd/github-actions.html. Can I set these options in config file as well?

[Alan-K-Biju-7]

Short answer: I do not think severity / confidence are currently supported as values inside Bandit's config file.

The config-file options listed in the docs are targets, exclude / exclude_dirs, skips, and tests: https://bandit.readthedocs.io/en/latest/config.html#bandit-settings

For severity and confidence filtering, use the CLI flags instead, for example:

bandit -r . --severity-level high --confidence-level high

Those options are documented in the man page: https://bandit.readthedocs.io/en/latest/man/bandit.html#options

For GitHub Actions, the Bandit action exposes them as action inputs named severity and confidence, which is why they show up there separately from the normal config file: https://bandit.readthedocs.io/en/latest/ci-cd/github-actions.html#inputs

So a practical workflow would be: keep plugin selection/exclusions in .bandit, bandit.yaml, or pyproject.toml, and apply severity/confidence thresholds in the command line or GitHub Action step.