diff --git a/Makefile b/Makefile
index b6fb1cb..a440b5d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: install-backend install-frontend install setup-hooks backend frontend db db-stop db-ready db-seed dev test test-backend test-frontend test-e2e typecheck generate-types generate-types-standalone check-types-fresh check-constants lint-backend format-backend fix-backend
+.PHONY: install-backend install-frontend install setup-hooks backend frontend db db-stop db-ready db-seed dev test test-backend test-frontend test-e2e typecheck generate-types generate-types-standalone check-types-fresh check-constants lint-backend format-backend fix-backend security-backend
 
 -include .env
 export
@@ -102,3 +102,6 @@ format-backend:
 
 fix-backend:
 	cd backend && uv run ruff check --fix . && uv run ruff format .
+
+security-backend:
+	cd backend && uv run bandit -r . -c pyproject.toml
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index bc09aae..c449ea3 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -22,6 +22,7 @@ dev = [
     "mypy>=1.13.0",
     "ruff>=0.14.10",
     "pytest-cov>=7.0.0",
+    "bandit>=1.9.2",
 ]
 
 [tool.mypy]
@@ -68,3 +69,10 @@ exclude_lines = [
 ]
 show_missing = true
 
+[tool.bandit]
+exclude_dirs = ["tests", ".venv"]
+skips = [
+    "B101",  # assert warnings (used in tests)
+    "B311",  # random for non-security purposes (invite codes)
+]
+