# python/ruff

> Lints every Python file with the Ruff rules for the level, security rules included.

Lints every Python file with the Ruff rules for the level, security rules included.

Part of the [`python`](/reference/configurations/python/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), per file. It runs ruff. `gspot check --fix` fixes what it can.

## Why

Undefined names, unused code, and insecure calls fail at run time or open a security hole, and a reader misses them.

## What to do

Run `gspot check --fix` for the rules that fix themselves. Turn one rule off with `gspot ignore python/ruff --rule <code> --reason "<why>"`, and add `--paths` to limit it.

## Example

`eval(user_input)` reports S307. Parse the input instead, and allow only known operations.

## Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

```shell
gspot ignore python/ruff --paths "<glob>" --reason "<why>"
gspot ignore python/ruff --rule <rule> --reason "<why>"
```

To silence one place, write a comment such as:

```text
import plugins  # noqa: F401 # the module registers its plugins on import
```