diff --git a/.zuul.yaml b/.zuul.yaml
index 7cefee77..85a56388 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -4,6 +4,7 @@
       - publish-stx-docs
       - stx-api-ref-jobs
       - stx-release-notes-jobs
+      - stx-bandit-jobs
     check:
       jobs:
         - openstack-tox-pep8
diff --git a/test-requirements.txt b/test-requirements.txt
index 47d1aec2..0375f1c0 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,3 +1,4 @@
 bashate >= 0.2
 PyYAML >= 3.1.0
 yamllint >= 0.5.2
+bandit!=1.6.0,>=1.1.0,<2.0.0
diff --git a/tox.ini b/tox.ini
index 7038b092..55631319 100644
--- a/tox.ini
+++ b/tox.ini
@@ -130,3 +130,9 @@ commands =
   rm -rf api-ref/build
   sphinx-build -W -b html -d api-ref/build/doctrees api-ref/source api-ref/build/html
 whitelist_externals = rm
+
+[testenv:bandit]
+basepython = python3
+description = Bandit code scan for *.py files under config folder
+deps = -r{toxinidir}/test-requirements.txt
+commands = bandit -r {toxinidir}/ -x '**/.tox/**',**/.eggs/** -lll