# security/semgrep-registry

> Downloads and runs the public Semgrep packs in `tools.semgrep.registry_packs`.

Downloads and runs the public Semgrep packs in `tools.semgrep.registry_packs`.

Part of the [`security`](/reference/configurations/security/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs only when `gspot check --only security/semgrep-registry` names it, per file. It runs semgrep. It needs network access. It skips until you set `tools.semgrep.registry_packs`.

## Why

The registry packs cover the common vulnerability classes, and their license keeps them out of this package.

## What to do

Change the code the way the message says, or turn the rule off for a path with `gspot ignore security/semgrep-registry --rule <id> --reason "<why>"`.

## Example

Code that matches a registry rule reports its upstream ID. Fix the code at that location, then rerun with network access.

## Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

```shell
gspot ignore security/semgrep-registry --paths "<glob>" --reason "<why>"
gspot ignore security/semgrep-registry --rule <rule> --reason "<why>"
```

A suppression comment is refused; use `gspot ignore`.