[bandit]
# B404: import subprocess — intentional; RepoMend runs git, docker, semgrep via subprocess
# B603: subprocess without shell=True — all calls use fixed list args, no shell injection possible
# B607: start process with partial path — all commands are well-known tools (git, docker, semgrep)
# B101: assert used — test code only, filtered by repomend's test-path pre-filter
skips = B404,B603,B607,B101
