diff --git a/.gitignore b/.gitignore
index 01ddccc..93637ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,10 @@ build/
 .coverage
 htmlcov/
 
+# Security scanner
+.bandit
+bandit-report.*
+
 # Misc
 *.log
 .DS_Store
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b185e08..36bbcf9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -43,7 +43,8 @@ This format is enforced by the auto-merge workflow, which validates the PR title
 
 ```bash
 make test-all    # Runs pytest-cov + molecule
-make lint-all    # Runs ruff, pyright, ansible-lint, checkmake
+make lint-all    # Runs ruff, pyright, bandit, ansible-lint, checkmake
+make lint-bandit # Security scan with bandit
 make pytest-cov  # Unit tests with 100% coverage enforcement
 make molecule    # All 7 molecule scenarios
 ```
@@ -52,5 +53,6 @@ make molecule    # All 7 molecule scenarios
 
 - **ruff**: Line length 120
 - **pyright**: Strict mode
+- **bandit**: Security scan for Python code (no high/medium severity issues)
 - **Test coverage**: 100% required
 - **ansible-lint**: For all Ansible content
diff --git a/README.md b/README.md
index 2f5d213..47b7fbe 100644
--- a/README.md
+++ b/README.md
@@ -292,7 +292,8 @@ source .venv/bin/activate
 ### Running Linters
 
 ```bash
-make lint          # Python (ruff + pyright)
+make lint          # Python (ruff + pyright + bandit)
+make lint-bandit   # Security scan only
 make ansible-lint  # Ansible
 make makefile-lint # Makefile
 ```
@@ -388,7 +389,8 @@ The test checks two things:
 | `status` | Checks runner status |
 | `remove` | Removes a runner completely |
 | `list` | Lists registered runners with live status |
-| `lint` | Runs Python linters |
+| `lint` | Runs Python linters (ruff, pyright, bandit) |
+| `lint-bandit` | Runs `bandit` security scanner |
 | `ansible-lint` | Runs `ansible-lint` |
 | `test-unit` | Runs unit tests with coverage |
 | `test-integration` | Runs integration tests |