diff --git a/ruff.toml b/ruff.toml
index deb7b13f..c2f44986 100644
--- a/ruff.toml
+++ b/ruff.toml
@@ -24,7 +24,7 @@ extend-select = [
   'PLE',  # pylint errors
   'PLR',  # pylint refactors
   'PLW',  # pylint warnings
-#  'S',   # flake8-bandit
+  'S',    # flake8-bandit
   'SIM',  # flake8-simplify
   'UP',   # pyupgrade
   'W'     # pycodestyle
@@ -36,3 +36,8 @@ known-first-party = [
   'user_agent',
   'typings'
 ]
+
+[lint.per-file-ignores]
+"**/test_*.py" = [
+  "S101" # allow using assert in tests
+]
diff --git a/scripts/download_sa_advisories.py b/scripts/download_sa_advisories.py
index 19f520a3..a90c9f45 100755
--- a/scripts/download_sa_advisories.py
+++ b/scripts/download_sa_advisories.py
@@ -53,7 +53,7 @@ def download_sa_advisories_from_rest_api(last_modified_timestamp: int) -> None:
   retry = True
   while url != '':
     print(f'fetching {url}')
-    response = requests.get(url, headers={'user-agent': user_agent})
+    response = requests.get(url, headers={'user-agent': user_agent}, timeout=60)
 
     # if we're making too many requests and have not already retried the current
     # url, wait the requested number of seconds before doing a retry
diff --git a/scripts/generate_osv_advisories.py b/scripts/generate_osv_advisories.py
index 9ed7fefa..b214d598 100755
--- a/scripts/generate_osv_advisories.py
+++ b/scripts/generate_osv_advisories.py
@@ -39,6 +39,7 @@ def fetch_drupal_node(nid: str) -> drupal.Node:
     resp = requests.get(
       f'https://www.drupal.org/api-d7/node/{nid}.json',
       headers={'user-agent': user_agent},
+      timeout=60,
     )
 
     if resp.status_code == 200:
@@ -365,7 +366,9 @@ def fetch_drupal_packages_available_on_packagist() -> list[str]:
   """
   Fetches a list of all Drupal packages that are available on packagist.org
   """
-  resp = requests.get('https://packagist.org/packages/list.json?vendor=drupal')
+  resp = requests.get(
+    'https://packagist.org/packages/list.json?vendor=drupal', timeout=60
+  )
 
   if resp.status_code != 200:
     raise RuntimeError(
diff --git a/scripts/list_changed_advisories.py b/scripts/list_changed_advisories.py
index c13e90c6..da82d36f 100755
--- a/scripts/list_changed_advisories.py
+++ b/scripts/list_changed_advisories.py
@@ -8,7 +8,8 @@
 import subprocess
 
 output = subprocess.check_output(
-  ['git', 'status', '--untracked-files', '--porcelain'], text=True
+  ['git', 'status', '--untracked-files', '--porcelain'],  # noqa: S607
+  text=True,
 )
 
 for line in output.split('\n'):
diff --git a/scripts/precache_nodes.py b/scripts/precache_nodes.py
index d91aa3b4..503a900f 100755
--- a/scripts/precache_nodes.py
+++ b/scripts/precache_nodes.py
@@ -26,7 +26,7 @@ def fetch_drupal_nodes(nids: list[str], retry: bool = True) -> list[drupal.Node]
   for nid in nids:
     url += f'nid[]={nid}&'
 
-  resp = requests.get(url, headers={'user-agent': user_agent})
+  resp = requests.get(url, headers={'user-agent': user_agent}, timeout=60)
 
   if retry and resp.status_code == 429:
     seconds = int(resp.headers.get('Retry-After', 0))
diff --git a/scripts/validate_advisories.py b/scripts/validate_advisories.py
index 935990d5..47f9e810 100755
--- a/scripts/validate_advisories.py
+++ b/scripts/validate_advisories.py
@@ -14,7 +14,8 @@
 report_valid = False
 
 resp = requests.get(
-  'https://raw.githubusercontent.com/ossf/osv-schema/refs/heads/main/validation/schema.json'
+  'https://raw.githubusercontent.com/ossf/osv-schema/refs/heads/main/validation/schema.json',
+  timeout=60,
 )
 
 if resp.status_code != 200: