# security/semgrep > Runs the Semgrep packs of each configuration, and the repository rules, over changed files. Runs the Semgrep packs of each configuration, and the repository rules, over changed files. Part of the [`security`](/reference/configurations/security/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `push` [stage](/start/concepts/#stage), per file. It runs semgrep. ## Why An injection or a logged secret reads like ordinary code, and a pattern rule finds it before a reviewer has to. ## What to do Change the code the way the message says. Turn one rule off for a path with `gspot ignore security/semgrep --rule --paths --reason ""`. ## Example `eval(userInput)` matches a rule against dynamic evaluation and reports its ID and location. Parse the input instead, and allow only known operations. ## Turn it off Turn it off for some files, or one of its lint rules, with a reason: ```shell gspot ignore security/semgrep --paths "" --reason "" gspot ignore security/semgrep --rule --reason "" ``` A suppression comment is refused; use `gspot ignore`.