# postgres/definer-search-path

> Checks that every SECURITY DEFINER function sets its search_path.

Checks that every SECURITY DEFINER function sets its search\_path.

Part of the [`postgres`](/reference/configurations/postgres/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself.

## Why

A definer function runs with its owner’s rights, and a caller who controls the search path chooses the objects it touches.

## What to do

Give the function an empty `search_path` in its definition, and qualify every name inside it.

## Example

A `SECURITY DEFINER` function without a safe search path reports a finding. Add `SET search_path = ''` to the definition, and schema-qualify the objects in its body.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore postgres/definer-search-path --paths "<glob>" --reason "<why>"
```