diff --git a/.zuul.yaml b/.zuul.yaml
index 465306498..0bee17b47 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -1,5 +1,7 @@
 ---
 - project:
+    templates:
+      - stx-bandit-jobs
     check:
       jobs:
         - stx-puppet-linters
diff --git a/test-requirements.txt b/test-requirements.txt
index 8ae3e22fd..3ee3d2794 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,3 +1,4 @@
 # hacking pulls in flake8
 hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
 bashate >= 0.2
+bandit!=1.6.0,>=1.1.0,<2.0.0
diff --git a/tox.ini b/tox.ini
index 8b8285ca8..fc916874d 100644
--- a/tox.ini
+++ b/tox.ini
@@ -81,3 +81,8 @@ show-source = True
 ignore = E123,E125,E501,H405,W504
 exclude = .venv,.git,.tox,dist,doc,*lib/python*,*egg,build,release-tag-*
 
+[testenv:bandit]
+basepython = python3
+description = Bandit code scan for *.py files under config folder
+deps = -r{toxinidir}/test-requirements.txt
+commands = bandit -r {toxinidir}/ -x '**/.tox/**,**/.eggs/**' -lll