# Bandit configuration for the QGIS plugin security scanner
# (https://plugins.qgis.org/docs/security-scanning/config-files)
#
# _vendor/ contains an unmodified copy of the third-party xlsxwriter library
# (BSD licensed), bundled because QGIS's Python does not ship an xlsx writer.
# Bandit's "possible hardcoded password" findings there are false positives:
# empty-string DEFAULT PARAMETERS of its worksheet/chartsheet protect() API
# and internal token comparisons, not credentials. The library is scanned
# upstream by its own project; we exclude it here rather than patch vendored
# code.
#
# B110/B112 (try/except pass|continue) are skipped: each such block in this
# plugin deliberately keeps a non-essential step (styling, metadata caching,
# optional statistics) from aborting a long-running download, and is
# commented at the site explaining why.

[bandit]
skips = B105,B107,B110,B112
exclude = ./_vendor
exclude_dirs = _vendor
