B404-B603- Categorisation as warnings

[ericwb]

Hi

Im running bandit against my python project (its a great tool, i love it!) but there are some things that could be improved

Im using subprocess.call, but with shell set to False, so im not vulnerable to command injection there. However, i have two errors in my build.

B404 - as im using subprocess
B607 - as, despite not being vulnerable to command injection, i need to be careful

Those recommendations are great, but in my opinion should be categorised as warnings rather than vulnerabilities. I have been reading and most of the people ignore those rules by default

Would be possible to have this amended?

Thanks

[pzelnip]

I agree, as oftentimes it's necessary to shell out to the OS, and (unless I'm missing something) subprocess is the current suggested way of doing this, so flagging just an import of subprocess as a issue is problematic.