want to take this one on @davidak ?

#318 is needed to use a sane name. I might find the time to do it then, but feel free to do it yourself.

This bug seems to be caused by inconsistent behavior of Bandit (and incomplete documentation).

If you use .bandit file, you need to start the file with text “[bandit]” and then add the arguments. For example:

[bandit]
exclude: \tests,\doc,\misc
tests: B101,B102,B104 

But if you want to use separate config file with "–configfile" argument on the command line, you have to remove the text “[bandit]”, replace “exclude” with “exclude_dirs” and add the values inside square brackets like this:

exclude_dirs: [\tests,\doc,\misc]
tests: [B101,B102,B104]

Hi, the following may be helpful to configure bandit, for example, to avoid raising B101 assert_used warnings on python tests

• Document how to use Bandit #603 (comment)

https://bandit.readthedocs.io/en/latest/config.html says .bandit should be an INI file (which uses = instead of :). The only thing incorrect is that it implies you don't need to use -c .bandit because that's --ini .bandit and not needed when using -r which is false here. I suggest Bandit prefer .bandit, pyproject.toml, and setup.cfg by default, overridable with arguments like -c, and to replace --ini with -c or --config (aka --configfile).