[openprivacy]

What changed

No changes for the user.

No security behavior changes.

Why

Reduce Bandit noise by excluding tests, specs, and the local virtual environment, while documenting deliberate clipboard subprocess exceptions with targeted # nosec annotations.

The suppressions apply only to intentional clipboard subprocess usage already covered by CLIP-001 in SECURITY-EXCEPTIONS.md.

Checklist

• PR title is a valid Conventional Commit
• Every commit on the branch is a valid Conventional Commit — all of them land on main
  and each one is a changelog candidate
• Branch tidied: fixup commits squashed into what they fix
• Breaking? Marked with ! or a BREAKING CHANGE: footer in the PR description.
  Remember: any change to a command name, flag, exit code, or output format is breaking.
• Tests added or updated
• uv run pytest, ruff check, mypy, and pylint src tests all pass locally
• No secret value can reach argv, logs, stdout/stderr, an exception, or a file.
  Deliberate exceptions are recorded in SECURITY-EXCEPTIONS.md.
• Did not hand-edit the version in pyproject.toml, __version__, the keychain-cli
  version in uv.lock, .release-please-manifest.json, or CHANGELOG.md — Release Please
  owns those

[github-actions]

🔑 Gitleaks Secrets Detection Results

Branch: test/clean-up-bandit-tests
Commit: 02ef5bf

Argus Security Scan Results

Status: PASS ✅

Threshold: high

Summary

Severity	Count
🚨 Critical	0
⚠️ High	0
🟡 Medium	0
🔵 Low	0
ℹ️ Info	0
Total	0

Scanner Results

gitleaks (0 findings)

No findings.

---

Generated by Argus

[github-actions]

🐍 Bandit Python Security Results

Branch: test/clean-up-bandit-tests
Commit: 02ef5bf

Argus Security Scan Results

Status: PASS ✅

Threshold: high

Summary

Severity	Count
🚨 Critical	0
⚠️ High	0
🟡 Medium	0
🔵 Low	0
ℹ️ Info	0
Total	0

Scanner Results

bandit (0 findings)

No findings.

---

Generated by Argus