diff --git a/lower-constraints.txt b/lower-constraints.txt
index 425f6080..41e65abc 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -48,5 +48,5 @@ reno==1.8.0  # Apache2
 sphinxcontrib-httpdomain==1.6.0 # Apache-2.0
 doc8==0.6.0 # Apache-2.0
 Pygments==2.2.0 # BSD
-bandit==1.1.0 # Apache-2.0
+bandit==1.6.0 # Apache-2.0
 os-api-ref==1.0.0 # Apache-2.0
diff --git a/test-requirements.txt b/test-requirements.txt
index 67ff4526..4d8c22f8 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -21,5 +21,5 @@ sphinxcontrib-pecanwsme>=0.8 # Apache-2.0
 reno>=1.8.0 # Apache-2.0
 doc8>=0.6.0 # Apache-2.0
 Pygments>=2.2.0 # BSD license
-bandit>=1.1.0 # Apache-2.0
+bandit>=1.6.0 # Apache-2.0
 os-api-ref>=1.0.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index 7ddf40e0..28d9806d 100644
--- a/tox.ini
+++ b/tox.ini
@@ -30,7 +30,7 @@ commands =
 [testenv:bandit]
 basepython = python3
 deps = -r{toxinidir}/test-requirements.txt
-commands = bandit -r cloudkitty -n5 -x tests -ll
+commands = bandit -r cloudkitty -n5 -x cloudkitty/tests/* -ll
 
 [testenv:cover]
 basepython = python3