Configurations

gspot selects configurations from the files of each scope. gspot add <name> and gspot remove <name> change the selection, and gspot list shows it.

Languages

Configuration	What it checks
bash	Shell scripts, hooks, and task files: lint, formatting, syntax, and the structure rules for shell.
css	Style sheets and the style blocks of components: the standard rules, one layout, and module classes that are defined and used. SCSS gets formatting only.
html	HTML files: valid structure, accessibility, and no inline scripts or event handlers.
javascript	JavaScript files: the shipped lint rules, type checks through JSDoc, and no unused code.
markdown	Markdown files: one style and layout, and code blocks that parse.
python	Python sources: lint, layout, strict types, import contracts, docstrings that match their signatures, and no unused code or dependencies.
sql	SQL files: layout and style in your dialect, and at level all, comments and file length.
swift	Swift sources and their XCTest and Swift Testing tests: lint and analyzer rules for each level, one format, a clean build, no unused code, a reason on each disabled test, and a coverage floor.
typescript	TypeScript files: the strict compiler and the shipped lint and structure rules.

Frameworks

Configuration	What it checks
astro	Astro components: the recommended and accessibility rules for frontmatter, markup, and scripts, and a type check of each component.
expo	Expo apps: rules for public environment variables and DOM exports, and Expo’s own project and SDK checks. The React Native configuration adds the component and style rules.
express	Express services: security rules for request handlers.
fastapi	FastAPI routes: route rules, and security rules for request handlers when the security configuration is on.
nestjs	NestJS services: the compiler options that decorators need, correct providers, routes, and DTOs, and no circular modules.
nextjs	Next.js apps: the framework and hooks rules, and server code that never reaches the client. A Semgrep rule refuses ignoreBuildErrors and ignoreDuringBuilds in next.config.
react	React components: the recommended React and hooks rules as errors, and react-refresh rules, so Fast Refresh keeps component state.
react-dom	React apps in the browser: labels, alternative text, keyboard access, and valid ARIA attributes.
react-native	React Native apps: stable list keys, virtualized lists, touch targets that respond, and no credentials in AsyncStorage.
site	Sites built to a folder: the build, broken links, page weight, and the sitemap.
svelte	Svelte components: markup and script rules, HTML injection checks at both levels, and DOM and typing rules at level all.
vue	Vue components: template, script, and accessibility rules, HTML injection checks at both levels, and naming and ordering rules at level all.

Platforms

Configuration	What it checks
cloudflare	Cloudflare Pages and Workers: valid headers and redirects files, current binding types, and security rules for worker code.
supabase	A Supabase project: edge functions under Deno. Every storage bucket has a policy, and privileged keys stay in their allowed files.

Databases

Configuration	What it checks
postgres	Postgres migrations that do not lock tables or break running code, run in order, and never change after they ran, and schemas with row security, explicit grants, and an index under every foreign key.

Testing

Configuration	What it checks
jest	Jest suites: test lint rules and coverage floors.
pytest	pytest suites: test style rules, test-name prefixes, and a coverage floor before every push.
vitest	Vitest suites: test lint rules and coverage floors before every push.

Infrastructure

Configuration	What it checks
ansible	Ansible playbooks, roles, and collections: the lint rules of the Ansible project.
docker	Dockerfiles and Compose files: Dockerfile best practices, valid Compose files, a .dockerignore beside each Dockerfile, and image vulnerability scans.
github-actions	GitHub Actions workflows: valid syntax and expressions, security audits, and pinned actions.
nginx	nginx configuration: security mistakes, and a configuration test in a container.
openapi	A committed OpenAPI document that passes its lint rules and matches what its generator writes.
xcode	An Xcode project: property lists that parse, build settings files, and complete string catalogs. Asset catalogs hold their images, sources belong to a target, and entitlements stay on a list.

Libraries

Configuration	What it checks
drizzle	Drizzle: no update or delete without where, raw SQL only at paths the settings allow, and migrations that match the schema.
react-hook-form	React Hook Form: each form validates through a resolver, and no registered field also acts as a controlled one.
tanstack-query	TanStack Query: complete dependency lists, stable clients, and options in a fixed order.
testing-library	Lint rules for test files in projects that depend on Testing Library.
translations	Translated interfaces: no literal text in components, and message files that parse and stay complete in every locale.
trpc	tRPC routers: every procedure validates its input, and client code imports the server files named in trpc.server_files as types only.
zod	Zod schemas: no unsafe APIs, and the replacement for each deprecated one.
zustand	Zustand: state lives in store files, and components read it through a selector.

General

Configuration	What it checks
commits	Checks commit messages for a conventional type, an optional project scope, a first line of 72 characters or fewer, and a wrapped body.
dependencies	Checks for known advisories, one version per package, exact pins, one package manager, and a lockfile that matches its dependency file.
docs	Documentation links that reach their files, anchors, and sites, and documented paths and commands that exist. Level all requires a README in every scope and a LICENSE at the root.
duplication	Reports copied code across every language a configuration claims.
engineering	Rules for working and writing code. The [rules] setting turns them on or off.
files	Data and settings files parse, match their schema, and use one layout.
format	Prettier and editorconfig-checker on every file. One [format] block sets the indentation, line length, quotes, and line endings for every formatter.
gspot	Checks gspot.toml, generated files, and suppression reasons.
licenses	Checks the license of each installed dependency against the allowed list. An allowed-package record with a reason accepts one package.
naming	Checks every identifier, file, and folder for banned words, case, length, and word count.
prose	Comments and documentation: clear dates, link text, and alternative text. Level all adds the complete gspot style and the upstream Vale packages.
repository	Checks the files that Git tracks and their storage.
secrets	Checks environment files and examples, scans staged changes and pushed commits for secrets, and requires reasons for allowed values.
security	Unsafe code patterns in every file that a language configuration covers.
spelling	Spelling in every text file, with a reason for each allowed word.
structure	Structure rules that no standard linter ships, at level all: lone files, shared name prefixes, file and folder clashes, long files, trivial functions, and environment reads outside the environment readers.