default config file name

Is your feature request related to a problem? Please describe. The doc say i should create a YAML config file, but not how to name it. https://bandit.readthedocs.io/en/latest/config.html

Describe the solution you’d like Please recommend a sane default name, so it is consistent in any project and can be found by CI etc.

I recommend using .bandit.yml because it is hidden on Linux, UNIX and macOS and has an extension.

Describe alternatives you’ve considered I don’t see any alternatives. Leaving it as is leads to chaos!

Additional context Codacy says: “You can also use custom .bandit or bandit.yml config file.” I have also seen bandit.yaml in earlier issues.

For a sane solution, i look what similar tools do.

Most .name for INI-style config or .name.yml for YAML config.

pylintrc or .pylintrc: https://pylint.readthedocs.io/en/latest/user_guide/run.html#command-line-options

.flake8

.pycodestyle or config in setup.cfg or tox.ini: http://pycodestyle.pycqa.org/en/latest/intro.html#configuration

.pydocstyle, .pydocstyle.ini, .pydocstylerc, .pydocstylerc.ini: http://www.pydocstyle.org/en/2.1.1/usage.html#configuration-files

.coveragerc

.travis.yml, .circleci, .github, .appveyor.yml

[bittner]

I’d prefer to see a [bandit] section read from my tox.ini file, as do other tools (like pytest, flake8, behave, etc.), which can help to reduce clutter in Python projects.

Also, the options available in a configuration file need to be fully documented, ideally also printed by the CLI --help option (or so). See also #396.

[jdrowne]

Bump. As of this writing, documentation does not say the config file must be explicitly set via -c.