@@ -134,15 +134,6 @@ def exec_file():
         with change_exec_context(args, cwd, env):
             return self._execute_and_capture_output(exec_file)
 
-    @error_decorator
-    def m_exec_code(self, code):
-        self.log.info("Exec code %s", code)
-
-        def exec_code():
-            eval(code, globals())
-
-        return self._execute_and_capture_output(exec_code)
-
     @error_decorator
     def m_exec_file_observable(self, file_name, args=[], cwd=None, env=None):
         args = [] if args is None else args
 
@@ -13,10 +13,12 @@ def _VSCODE_convertToDataFrame(df):
     elif hasattr(df, "toPandas"):
         df = df.toPandas()
     else:
+        """ Disabling bandit warning for try, except, pass. We want to swallow all exceptions here to not crash on
+        variable fetching """
         try:
             temp = _VSCODE_pd.DataFrame(df)
             df = temp
-        except:
+        except:  # nosec
             pass
     return df
 
 
@@ -1,12 +1,13 @@
 # Query Jupyter server for defined variables list
 # Tested on 2.7 and 3.6
 import json as _VSCODE_json
+import ast as _VSCODE_ast
 
 # In IJupyterVariables.getValue this '_VSCode_JupyterTestValue' will be replaced with the json stringified value of the target variable
 # Indexes off of _VSCODE_targetVariable need to index types that are part of IJupyterVariable
 _VSCODE_targetVariable = _VSCODE_json.loads("""_VSCode_JupyterTestValue""")
 
-_VSCODE_evalResult = eval(_VSCODE_targetVariable["name"])
+_VSCODE_evalResult = _VSCODE_ast.literal_eval(_VSCODE_targetVariable["name"])
 
 # Find shape and count if available
 if hasattr(_VSCODE_evalResult, "shape"):
 
@@ -24,10 +24,12 @@
 
     print(json.dumps(server_info_list))
 except Exception:
-    import subprocess
+    """ Usage of subprocess is safe here as we are using run and are in control of all the arguments passed to it
+    flagging for execution of partial path is also not correct as it is a command, not a path """
+    import subprocess  # nosec
     import sys
 
-    result = subprocess.run(
+    result = subprocess.run(  # nosec
         ["jupyter", "notebook", "list", "--jsonlist"], capture_output=True
     )
     encoding = os.getenv("PYTHONIOENCODING", "utf-8")
 
@@ -4,7 +4,9 @@
 import json
 import logging
 import os
-import subprocess
+
+# See comment at our point of usage of subprocess on why this usage is ok
+import subprocess  # nosec
 import sys
 from vscode_datascience_helpers.daemon.daemon_python import (
     error_decorator,
@@ -53,7 +55,8 @@ def m_exec_module(self, module_name, args=[], cwd=None, env=None):
                     from notebook import notebookapp as app
 
                     return {"stdout": ".".join(list(str(v) for v in app.version_info))}
-                except Exception:
+                    """ We specifically don't want to bubble up an error from --version so pass exception here """
+                except Exception:  # nosec
                     pass
             # kernelspec, nbconvert are subcommands of jupyter.
             # python -m jupyter kernelspec, python -m jupyter nbconvert,
@@ -71,9 +74,9 @@ def m_exec_module(self, module_name, args=[], cwd=None, env=None):
             return super().m_exec_module(module_name, args, cwd, env)
 
     def _exec_with_subprocess(self, module_name, args=[], cwd=None, env=None):
-        # # result = subprocess.run([sys.executable, "-m"] + args, stdout=sys.stdout, stderr=sys.stderr)
-        # return self._execute_and_capture_output(lambda: subprocess.run([sys.executable, "-m", module_name] + args, stdout=sys.stdout, stderr=sys.stderr))
-        result = subprocess.run(
+        # The usage here traced up to our execModule function on the daemon and only goes down this path for jupyter subcommands
+        # in m_exec_module in this class if module_name == jupyter and we are in control of the args we know that we are safe here
+        result = subprocess.run(  # nosec
             [sys.executable, "-m", module_name] + args, capture_output=True
         )
         encoding = os.getenv("PYTHONIOENCODING", "utf-8")
 
@@ -7,7 +7,10 @@
 import os.path
 import signal
 import sys
-import subprocess
+
+# Only subprocess.PIPE is used in this file so we can ignore the subprocess warning for this file
+# The actual POpen is in kernel_launcher.py
+import subprocess  # nosec
 import threading
 import time
 from vscode_datascience_helpers.daemon.daemon_python import (
@@ -30,7 +33,8 @@ def close(self):
         """
         try:
             self.m_kill_kernel()
-        except:
+            """ We don't care about exceptions coming back from killing the kernel, so pass here """
+        except:  # nosec
             pass
         super().close()