Summary

Implements #1371 — adds a new Bandit plugin that detects when sensitive information is passed to logging or print calls.

What it detects

Flags calls to logging.*, print(), and pprint.* where arguments contain variable names associated with secrets:

• password, passwd, pwd, passphrase
• secret, api_key, apikey, api_secret, client_secret
• token, auth_token, bearer
• private_key, access_key, secret_key, signing_key
• credential, database_url, db_password, encryption_key

What it does NOT flag (false positive avoidance)

• username, user_name, total_count, elapsed, etc.
• Generic print/logging with non-sensitive variables
• Format strings without sensitive arguments

Test results

10 true positives detected
0 false positives on safe code

Example

# ❌ Flagged
logging.debug("Password: %s", password)
print(f"Token: {auth_token}")
logging.info("Key: %s" % private_key)

# ✅ Not flagged
logging.debug("User logged in: %s", username)
print("Hello world")
logging.info("Request completed in %s seconds", elapsed)

Files changed

• bandit/plugins/logging_sensitive_info.py — New plugin (155 lines)
• examples/sensitive_logging.py — Test cases
• setup.cfg — Plugin registration

Closes #1371