Add bandit security scanning

Run bandit over bitmath/ and tests/ as a dedicated GitHub Actions
workflow (push, pull request, weekly) and as part of make ci, so the
local build catches the same issues CI does.

Author: timlnx

.github/workflows/bandit.yml

@@ -0,0 +1,27 @@
+---
+name: Bandit Security Scan
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    branches: ["master"]
+  schedule:
+    - cron: "0 0 * * 0"
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6.0.2
+
+      - name: Perform Bandit Analysis
+        uses: PyCQA/bandit-action@v1
+        with:
+          targets: "bitmath/ tests/"

CLAUDE.md

@@ -27,11 +27,14 @@ Phases 1 (maintenance 1.4.0) and 2 (bitmath 2.0.0) are complete. The project:
 ## Common Commands
 
 ```bash
-# Run the full test suite with coverage (creates venv, runs pytest + linting)
+# Run the full test suite with coverage (creates venv, runs pytest + linting + bandit)
 make ci
 
+# Run security scan only
+make ci-bandit
+
 # Run linting only
-ruff check bitmath/ tests/
+make ci-pylint
 
 # Build a wheel
 make build
@@ -66,6 +69,14 @@ All unit values are normalized to bits internally; conversion between units happ
 
 **Constants:** `NIST`, `SI`, `NIST_PREFIXES`, `SI_PREFIXES`, `ALL_UNIT_TYPES`
 
+## Versioning
+
+The single source of truth for the version is the `VERSION` file. `pyproject.toml` reads it dynamically via `[tool.hatch.version]` — do not edit the version in `pyproject.toml` directly. The `Makefile` also reads `VERSION` for docs, man pages, and RPM builds. To bump the version, edit `VERSION` only.
+
+## Security Scanning
+
+Bandit runs as part of `make ci` via the `ci-bandit` target, scanning both `bitmath/` and `tests/`. It also runs as a GitHub Actions workflow (`.github/workflows/bandit.yml`) on push/PR to master and weekly. No issues were present as of 2.0.2.
+
 ## Testing Notes
 
 - Test runner: `pytest`

Makefile

@@ -216,5 +216,12 @@ ci-pylint:
 	@echo "#################################################"
 	. $(NAME)env3/bin/activate && pylint bitmath/__init__.py
 
-ci: clean uniquetestnames virtualenv ci-list-deps ci-pycodestyle ci-pylint ci-unittests
+ci-bandit:
+	@echo ""
+	@echo "#############################################"
+	@echo "# Running Bandit Security Scan in virtualenv"
+	@echo "#############################################"
+	. $(NAME)env3/bin/activate && bandit -r -v bitmath/ tests/
+
+ci: clean uniquetestnames virtualenv ci-list-deps ci-pycodestyle ci-pylint ci-bandit ci-unittests
 	:

requirements.txt

@@ -1,3 +1,4 @@
+bandit
 pycodestyle
 pylint
 pytest