Rapid growth in Python software has led developers to prioritize speed over secure coding, leaving deployed code vulnerable. Existing approaches, static analysis and standalone learning-based classifiers, suffer from poor generalization, high false-positive rates, or a lack of adaptive decision-making. This paper proposes a hybrid DevSecOps framework for Python CI/CD pipelines that integrates Bandit (static analysis), transformer-based models (CodeBERT, GraphCodeBERT, CodeGPT), and a reinforcement-learning (RL) agent via weighted fusion. Evaluated on a complete, independently-labeled dataset of 14,010 samples (2,357 vulnerable, 16.8%; 11,653 safe, 83.2%), all three transformer classifiers outperform the proposed Hybrid Ensemble, with GraphCodeBERT strongest overall (Accuracy = 0.9061, AUC = 0.9510, F1 = 0.7498) against the Hybrid Ensemble (Accuracy = 0.8994, AUC = 0.9395, F1 = 0.7335); both substantially outperform Bandit-only detection (Accuracy = 0.8380, AUC = 0.5854) and RL-only decision-making (Accuracy ≤ 0.8169, AUC ≤ 0.8220).

Conference Title

International Conference on Future Technologies (ICFT 2026)

Conference Country

Jordan

Conference Date

Oct. 18, 2026 - Oct. 22, 2026

Conference Sponsor

IEEE Xplore