You can put `# nosec` as a comment at the end of the line to skip that line.
See documentation for the Bandit scanner used by the QGIS Plugin repository here: https://bandit.readthedocs.io/en/latest/config.html#suppressing-individual-lines The scanner implementation, with details of the exact command that it runs (and that you can replicate locally or in CI), is here: https://github.com/qgis/QGIS-Plugins-Website/blob/18bf205e1c0733bc1f09f15430eff52c1a78a1a3/qgis-app/plugins/security_scanner.py Cheers, John -----Original Message----- From: QGIS-Developer <[email protected]> On Behalf Of Greg Troxel via QGIS-Developer Sent: 12 June 2026 00:59 To: C Hamilton via QGIS-Developer <[email protected]> Subject: Re: [QGIS-Developer] How do I get rid of the security warning on my plugin? C Hamilton via QGIS-Developer <[email protected]> writes: > My Lat Lon Tools plugin is getting two "Secrets Detection" warnings on > these two lines of code. > > lontile_ = "ABCDEFGHJKLMNPQRSTUVWXYZ" > > __base32 = '0123456789bcdefghjkmnpqrstuvwxyz' > > Those are certainly scarry, hazardous lines of code (sorry for the > sarchasm). But really how do I resolve this with your plugin scanners. > Those lines of code are probably the best way to represent the > geohash, and georef coordinate conversions. However, I also don't want > my plugins to be flagged with "Critical security issues found". By posting here, you request that the scanners be fixed. They are heuristics, which means they need tweaks when they are wrong. _______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer This email and any attachments are intended solely for the use of the named recipients. If you are not the intended recipient you must not use, disclose, copy or distribute this email or any of its attachments and should notify the sender immediately and delete this email from your system. UK Research and Innovation (UKRI) has taken every reasonable precaution to minimise risk of this email or any attachments containing viruses or malware but the recipient should carry out its own virus and malware checks before opening the attachments. UKRI does not accept any liability for any losses or damages which the recipient may sustain due to presence of any viruses. _______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
