exclude did not work for me, so I looked through official docs and found this:

We can specify dirs (and files as well) that we want to exclude in a list format

pyproject.toml:

[tool.bandit]
exclude_dirs = ["venv",]

From this documentation:

"Also you can configure bandit via pyproject.toml file. In this case you would explicitly specify the path to configuration via -c too."

Therefore, CLI option would look like this:

bandit -v -r . -c "pyproject.toml"

(will work without quotes as well)

I've never used bandit before, so if I got your question wrong - please feel free to write back, we will figure that out :D

I think this is an issue of bandit that I found here. I think you should use the absolute path to .venv as follows:

poetry run bandit --exclude "./absolute/path/.venv"  -r .

Use the absolute path in the config file too:

[tool.bandit]
targets = "my_package"
exclude = "./absolute/path/.venv" #

I solved the problem by adding to my requirements.txt bandit[toml]==1.7.4 to get it to work

bandit[toml]==1.7.4

and if you are working with pre-commit:

-   repo:  https://github.com/PyCQA/bandit
    rev: 1.7.4
    hooks:
    -   id: bandit
        args: ["-c", "pyproject.toml"]
        additional_dependencies: [".[toml]"]