update bandit submodule
add coverage to spec