diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e207f2ce..70809785 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,7 @@ jobs:
       pull-requests: read
     outputs:
       style: ${{ steps.filter.outputs.style }}
+      security: ${{ steps.filter.outputs.security }}
       unit-tests: ${{ steps.filter.outputs.unit-tests }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # @v2
@@ -34,6 +35,11 @@ jobs:
               - '.github/**/*'
               - 'src/**/*'
               - 'pyproject.toml'
+            security:
+              - '.github/**/*'
+              - 'src/**/*'
+              - 'pyproject.toml'
+              - '.bandit'
            # unit-tests:
            #   - '.github/**/*'
            #   - 'src/**/*'
@@ -45,6 +51,14 @@ jobs:
     needs: changes
     uses: ./.github/workflows/style.yml
 
+  security:
+    if: ${{ needs.changes.outputs.security == 'true' }}
+    needs: [changes, style]
+    uses: ./.github/workflows/security.yml
+    permissions:
+      contents: read
+      security-events: write
+
   # unit-tests:
   #   if: ${{ needs.changes.outputs.unit-tests == 'true' }}
   #   needs: [changes, style]
@@ -59,6 +73,7 @@ jobs:
     needs:
      - changes
      - style
+     - security
      # - unit-tests
      # - coverage
     if: always()
diff --git a/.github/workflows/requirements/security.txt b/.github/workflows/requirements/security.txt
new file mode 100644
index 00000000..47765662
--- /dev/null
+++ b/.github/workflows/requirements/security.txt
@@ -0,0 +1 @@
+bandit[sarif]==1.8.6
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 00000000..132e6bcd
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,79 @@
+name: Security Checks
+on:
+  workflow_call:
+
+
+jobs:
+  bandit-scan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      # https://bandit.readthedocs.io/en/latest/faq.html#under-which-version-of-python-should-i-install-bandit
+      - name: Set up Python 3.10
+        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55
+        with:
+          python-version: '3.10'
+          cache: 'pip'
+          cache-dependency-path: '.github/workflows/requirements/security.txt'
+
+      - name: Install Python dependencies
+        run: |
+          pip install -r .github/workflows/requirements/security.txt
+
+      - name: Run Bandit
+        run: |
+          bandit -r src -f sarif -o results.sarif
+
+      # upload security results to github; a bot will add inline comments to the PR if any issues are found
+      # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
+      - name: Upload SARIF file
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: bandit
+
+  codeql-analyze:
+    name: CodeQL Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: python
+          build-mode: none
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"
diff --git a/src/hubcast/clients/github/auth.py b/src/hubcast/clients/github/auth.py
index 3643885e..4157fc13 100644
--- a/src/hubcast/clients/github/auth.py
+++ b/src/hubcast/clients/github/auth.py
@@ -5,8 +5,9 @@
 import gidgethub.apps as gha
 from gidgethub import aiohttp as gh_aiohttp
 
-#: location for authenticated app to get a token for one of its installations
-INSTALLATION_TOKEN_URL = "app/installations/{installation_id}/access_tokens"
+# location for authenticated app to get a token for one of its installations
+# bandit thinks this is a hardcoded password, we ignore security checks on this line
+INSTALLATION_TOKEN_URL = "app/installations/{installation_id}/access_tokens"  # nosec B105
 
 
 class TokenCache: