Security and secrets

These configurations hold security checks. gspot always selects secrets, dependencies, and security. It selects docker and github-actions when it finds their files:

Configuration	What it checks
secrets	Gitleaks scans staged changes and pushed commits. TruffleHog scans pushed commits.
dependencies	OSV-Scanner checks lockfiles for known vulnerable packages at push.
security	Semgrep runs shipped and local rules at push, including the rules of the Next.js and Swift configurations, and selected public rule packs manually.
docker	Trivy checks container settings and a selected image. See Docker checks.
github-actions	zizmor finds unsafe workflows and unpinned actions at commit.

At push, TruffleHog sends possible secrets to their issuing service to check whether they still work. This needs network access.

If gspot finds a real secret, revoke or rotate it first, then remove it from the code. Deleting the line leaves the secret in Git history.

Semgrep

Run the shipped Semgrep rules and your own:

gspot check --only security/semgrep

Add your rule files with tools.semgrep.rule_files. To run public rule packs, list them in tools.semgrep.registry_packs and run:

gspot check --only security/semgrep-registry

The rule packs need network access. To turn a lint rule off for some paths, add an ignore with a reason. See Ignore a finding.