diff --git a/tox.ini b/tox.ini
index c5f06c77..fba2f4c7 100644
--- a/tox.ini
+++ b/tox.ini
@@ -78,7 +78,8 @@ exclude=.venv,.git,.tox,dist,*egg,build
 
 [bandit]
 commands =
-  bandit -r monasca_persister -n5 -x monasca_persister/tests
+# B303  cassandra metrics repository uses SHA1 for metric_id
+  bandit -r monasca_persister -n5 -s B303 -x monasca_persister/tests
 
 [hacking]
 local-check-factory = monasca_persister.hacking.checks.factory