I think it might be "detect-secrets" instead of bandit in his situation, so you can refer to it's documentation: https://github.com/Yelp/detect-secrets#inline-allowlisting
Le ven. 12 juin 2026, 15:32, John Stevenson - BGS via QGIS-Developer < [email protected]> a écrit : > You can put `# nosec` as a comment at the end of the line to skip that > line. > > See documentation for the Bandit scanner used by the QGIS Plugin > repository here: > > > https://bandit.readthedocs.io/en/latest/config.html#suppressing-individual-lines > > The scanner implementation, with details of the exact command that it runs > (and that you can replicate locally or in CI), is here: > > > https://github.com/qgis/QGIS-Plugins-Website/blob/18bf205e1c0733bc1f09f15430eff52c1a78a1a3/qgis-app/plugins/security_scanner.py > > Cheers, > John > > -----Original Message----- > From: QGIS-Developer <[email protected]> On Behalf > Of Greg Troxel via QGIS-Developer > Sent: 12 June 2026 00:59 > To: C Hamilton via QGIS-Developer <[email protected]> > Subject: Re: [QGIS-Developer] How do I get rid of the security warning on > my plugin? > > C Hamilton via QGIS-Developer <[email protected]> writes: > > > My Lat Lon Tools plugin is getting two "Secrets Detection" warnings on > > these two lines of code. > > > > lontile_ = "ABCDEFGHJKLMNPQRSTUVWXYZ" > > > > __base32 = '0123456789bcdefghjkmnpqrstuvwxyz' > > > > Those are certainly scarry, hazardous lines of code (sorry for the > > sarchasm). But really how do I resolve this with your plugin scanners. > > Those lines of code are probably the best way to represent the > > geohash, and georef coordinate conversions. However, I also don't want > > my plugins to be flagged with "Critical security issues found". > > By posting here, you request that the scanners be fixed. They are > heuristics, which means they need tweaks when they are wrong. > > > _______________________________________________ > QGIS-Developer mailing list > [email protected] > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer > > > This email and any attachments are intended solely for the use of the > named recipients. If you are not the intended recipient you must not use, > disclose, copy or distribute this email or any of its attachments and > should notify the sender immediately and delete this email from your > system. UK Research and Innovation (UKRI) has taken every reasonable > precaution to minimise risk of this email or any attachments containing > viruses or malware but the recipient should carry out its own virus and > malware checks before opening the attachments. UKRI does not accept any > liability for any losses or damages which the recipient may sustain due to > presence of any viruses. > > _______________________________________________ > QGIS-Developer mailing list > [email protected] > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer >
_______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
