[bandit]
# B101 (assert_used) is skipped — assertions are documentation in
# tests and pre-conditions in production; intentional. The
# project targets Python 3.10+ which still has `assert`, and
# Python's `-O` flag is not part of the production deployment
# story (we run with `-OO` only in benchmarks).
#
# B104 (hardcoded_bind_all_interfaces) is intentional —
# llmhotspot is a LAN-sharing proxy; the entire product exists
# to bind on 0.0.0.0 and let peer devices reach the host. The
# v0.3.4 / v0.7.x S-09 check + ``llmhs doctor --exposure``
# catch the actual footgun (admin-bind=0.0.0.0 without
# mTLS); bandit is a sanity check, not the policy gate.
#
# B501 (request_with_no_cert_validation) is intentionally
# disabled in the chatbox CLI: the host's default TLS is
# self-signed, and the operator has explicitly opted into
# this trust model by pointing the chatbox at the host. Each
# call site carries a `# nosec B501` + rationale comment so
# the bypass is auditable.
skips = B101,B104,B501

# Don't scan the test suite, venvs, or build artifacts.
exclude_dirs =
    tests,
    .venv,
    build,
    dist
