Clear out vulnerabilities of medium severity reported by `bandit`

[gridhead]

We definitely would not want to ship a vulnerable* code now, would we?

*The severity is medium but it is still something that we would want to take care of.

This issue has been migrated from gridhead/mdapi#55.