diff --git a/.zuul.yaml b/.zuul.yaml
index 8d0f1491..b42a706f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -3,6 +3,7 @@
     templates:
       - publish-stx-docs
       - stx-release-notes-jobs
+      - stx-bandit-jobs
     check:
       jobs:
         - openstack-tox-pep8
diff --git a/test-requirements.txt b/test-requirements.txt
index 2f486674..6c854bcb 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -26,3 +26,4 @@ testtools>=1.4.0 # MIT
 # This also needs xvfb library installed on your OS
 xvfbwrapper>=0.1.3 #license: MIT
 pyOpenSSL>=0.14
+bandit!=1.6.0,>=1.1.0,<2.0.0
diff --git a/tox.ini b/tox.ini
index c2219238..ba4949f4 100644
--- a/tox.ini
+++ b/tox.ini
@@ -98,3 +98,9 @@ basepython = python3
 envdir = {toxworkdir}/releasenotes
 deps = -r{toxinidir}/doc/requirements.txt
 commands = reno new {posargs}
+
+[testenv:bandit]
+basepython = python3
+description = Bandit code scan for *.py files under config folder
+deps = -r{toxinidir}/test-requirements.txt
+commands = bandit -r {toxinidir}/ -x '**/.tox/**,**/.eggs/**' -lll