diff --git a/alembic/env.py b/alembic/env.py
index 9cb256e1..ba153d44 100644
--- a/alembic/env.py
+++ b/alembic/env.py
@@ -89,6 +89,7 @@ def run_migrations_online():
         with context.begin_transaction():
             context.run_migrations()
 
+
 if context.is_offline_mode():
     run_migrations_offline()
 else:
diff --git a/deckhand/barbican/driver.py b/deckhand/barbican/driver.py
index a3fde93a..83dc9291 100644
--- a/deckhand/barbican/driver.py
+++ b/deckhand/barbican/driver.py
@@ -56,7 +56,7 @@ class BarbicanDriver(object):
                       'base64-encoding payload of type %s for '
                       'document [%s, %s] %s.', type(payload),
                       secret_doc.schema, secret_doc.layer, secret_doc.name)
-            secret_type = 'opaque'
+            secret_type = 'opaque'  # nosec  # not a hardcoded password
             try:
                 payload = base64.encode_as_text(repr(payload))
             except Exception:
@@ -96,7 +96,7 @@ class BarbicanDriver(object):
                       .format((i + 1), CONF.secret_create_attempts))
             try:
                 return self._do_create_secret(secret_args)
-            except Exception as e:
+            except Exception:
                 if i == (CONF.secret_create_attempts - 1):
                     # This was the last attempt, re-raise any error
                     raise
diff --git a/deckhand/engine/revision_diff.py b/deckhand/engine/revision_diff.py
index 977fdaa5..e218630e 100644
--- a/deckhand/engine/revision_diff.py
+++ b/deckhand/engine/revision_diff.py
@@ -258,7 +258,7 @@ def _diff_buckets(b1, b2):
                         DeepDiff(d['metadata'],
                                  b2_tmp[k]['metadata']).json)
                 except Exception as ex:
-                        raise errors.DeepDiffException(details=str(ex))
+                    raise errors.DeepDiffException(details=str(ex))
 
                 change_details.update({
                     str(k): {'data_changed': data_changed,
diff --git a/deckhand/tests/unit/common/test_utils.py b/deckhand/tests/unit/common/test_utils.py
index e04590f4..26d5987f 100644
--- a/deckhand/tests/unit/common/test_utils.py
+++ b/deckhand/tests/unit/common/test_utils.py
@@ -198,7 +198,7 @@ class TestJSONPathReplaceNegative(test_base.DeckhandTestCase):
         error_re = (".*missing the pattern %s specified under .* at path %s.*")
 
         self.assertRaisesRegex(errors.MissingDocumentPattern,
-                               error_re % ("way invalid", "\$.path"),
+                               error_re % ("way invalid", r"\$.path"),
                                utils.jsonpath_replace,
                                empty_body,
                                value="test",
diff --git a/requirements.txt b/requirements.txt
index 7383ec08..20d6bedd 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,7 +2,7 @@
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
 
-hacking==1.1.0
+hacking==2.0.0
 
 alembic==1.0.1
 beaker==1.10.0
diff --git a/test-requirements.txt b/test-requirements.txt
index 600380e1..647c2616 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -9,7 +9,7 @@ python-subunit==1.3.0
 os-testr==1.0.0
 testrepository==0.0.20
 testtools==2.3.0
-bandit==1.5.1
+bandit==1.6.2
 # NOTE(felipemonteiro): Pin here because later versions require that
 # content-type be present in empty responses.
 gabbi==1.35.1
diff --git a/tox.ini b/tox.ini
index 2fa54089..873f0557 100644
--- a/tox.ini
+++ b/tox.ini
@@ -106,7 +106,7 @@ commands =
 # [H904] Delay string interpolations at logging calls.
 enable-extensions = H106,H203,H204,H205,H210,H904
 # [E731] Do not assign a lambda expression, use a def. This reduces readability in some cases.
-ignore = E731,H405
+ignore = E731,F405,H405,W504
 exclude =  .venv,.git,.tox,dist,*lib/python*,*egg,build,releasenotes,doc,alembic/versions
 
 [testenv:docs]