# Configurations > Choose configurations by the files and tools they check. gspot selects configurations from the files of each scope. `gspot add ` and `gspot remove ` change the selection, and `gspot list` shows it. ## Languages | Configuration | What it checks | | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [`bash`](/reference/configurations/bash/) | Shell scripts, hooks, and task files: lint, formatting, syntax, and the structure rules for shell. | | [`css`](/reference/configurations/css/) | Style sheets and the style blocks of components: the standard rules, one layout, and module classes that are defined and used. SCSS gets formatting only. | | [`html`](/reference/configurations/html/) | HTML files: valid structure, accessibility, and no inline scripts or event handlers. | | [`javascript`](/reference/configurations/javascript/) | JavaScript files: the shipped lint rules, type checks through JSDoc, and no unused code. | | [`markdown`](/reference/configurations/markdown/) | Markdown files: one style and layout, and code blocks that parse. | | [`python`](/reference/configurations/python/) | Python sources: lint, layout, strict types, import contracts, docstrings that match their signatures, and no unused code or dependencies. | | [`sql`](/reference/configurations/sql/) | SQL files: layout and style in your dialect, and at level all, comments and file length. | | [`swift`](/reference/configurations/swift/) | Swift sources and their XCTest and Swift Testing tests: lint and analyzer rules for each level, one format, a clean build, no unused code, a reason on each disabled test, and a coverage floor. | | [`typescript`](/reference/configurations/typescript/) | TypeScript files: the strict compiler and the shipped lint and structure rules. | ## Frameworks | Configuration | What it checks | | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`astro`](/reference/configurations/astro/) | Astro components: the recommended and accessibility rules for frontmatter, markup, and scripts, and a type check of each component. | | [`expo`](/reference/configurations/expo/) | Expo apps: rules for public environment variables and DOM exports, and Expo’s own project and SDK checks. The React Native configuration adds the component and style rules. | | [`express`](/reference/configurations/express/) | Express services: security rules for request handlers. | | [`fastapi`](/reference/configurations/fastapi/) | FastAPI routes: route rules, and security rules for request handlers when the security configuration is on. | | [`nestjs`](/reference/configurations/nestjs/) | NestJS services: the compiler options that decorators need, correct providers, routes, and DTOs, and no circular modules. | | [`nextjs`](/reference/configurations/nextjs/) | Next.js apps: the framework and hooks rules, and server code that never reaches the client. A Semgrep rule refuses ignoreBuildErrors and ignoreDuringBuilds in next.config. | | [`react`](/reference/configurations/react/) | React components: the recommended React and hooks rules as errors, and react-refresh rules, so Fast Refresh keeps component state. | | [`react-dom`](/reference/configurations/react-dom/) | React apps in the browser: labels, alternative text, keyboard access, and valid ARIA attributes. | | [`react-native`](/reference/configurations/react-native/) | React Native apps: stable list keys, virtualized lists, touch targets that respond, and no credentials in AsyncStorage. | | [`site`](/reference/configurations/site/) | Sites built to a folder: the build, broken links, page weight, and the sitemap. | | [`svelte`](/reference/configurations/svelte/) | Svelte components: markup and script rules, HTML injection checks at both levels, and DOM and typing rules at level all. | | [`vue`](/reference/configurations/vue/) | Vue components: template, script, and accessibility rules, HTML injection checks at both levels, and naming and ordering rules at level all. | ## Platforms | Configuration | What it checks | | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | [`cloudflare`](/reference/configurations/cloudflare/) | Cloudflare Pages and Workers: valid headers and redirects files, current binding types, and security rules for worker code. | | [`supabase`](/reference/configurations/supabase/) | A Supabase project: edge functions under Deno. Every storage bucket has a policy, and privileged keys stay in their allowed files. | ## Databases | Configuration | What it checks | | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`postgres`](/reference/configurations/postgres/) | Postgres migrations that do not lock tables or break running code, run in order, and never change after they ran, and schemas with row security, explicit grants, and an index under every foreign key. | ## Testing | Configuration | What it checks | | --------------------------------------------- | -------------------------------------------------------------------------------------------- | | [`jest`](/reference/configurations/jest/) | Jest suites: test lint rules and coverage floors. | | [`pytest`](/reference/configurations/pytest/) | pytest suites: test style rules, test-name prefixes, and a coverage floor before every push. | | [`vitest`](/reference/configurations/vitest/) | Vitest suites: test lint rules and coverage floors before every push. | ## Infrastructure | Configuration | What it checks | | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`ansible`](/reference/configurations/ansible/) | Ansible playbooks, roles, and collections: the lint rules of the Ansible project. | | [`docker`](/reference/configurations/docker/) | Dockerfiles and Compose files: Dockerfile best practices, valid Compose files, a `.dockerignore` beside each Dockerfile, and image vulnerability scans. | | [`github-actions`](/reference/configurations/github-actions/) | GitHub Actions workflows: valid syntax and expressions, security audits, and pinned actions. | | [`nginx`](/reference/configurations/nginx/) | nginx configuration: security mistakes, and a configuration test in a container. | | [`openapi`](/reference/configurations/openapi/) | A committed OpenAPI document that passes its lint rules and matches what its generator writes. | | [`xcode`](/reference/configurations/xcode/) | An Xcode project: property lists that parse, build settings files, and complete string catalogs. Asset catalogs hold their images, sources belong to a target, and entitlements stay on a list. | ## Libraries | Configuration | What it checks | | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | [`drizzle`](/reference/configurations/drizzle/) | Drizzle: no update or delete without `where`, raw SQL only at paths the settings allow, and migrations that match the schema. | | [`react-hook-form`](/reference/configurations/react-hook-form/) | React Hook Form: each form validates through a resolver, and no registered field also acts as a controlled one. | | [`tanstack-query`](/reference/configurations/tanstack-query/) | TanStack Query: complete dependency lists, stable clients, and options in a fixed order. | | [`testing-library`](/reference/configurations/testing-library/) | Lint rules for test files in projects that depend on Testing Library. | | [`translations`](/reference/configurations/translations/) | Translated interfaces: no literal text in components, and message files that parse and stay complete in every locale. | | [`trpc`](/reference/configurations/trpc/) | tRPC routers: every procedure validates its input, and client code imports the server files named in `trpc.server_files` as types only. | | [`zod`](/reference/configurations/zod/) | Zod schemas: no unsafe APIs, and the replacement for each deprecated one. | | [`zustand`](/reference/configurations/zustand/) | Zustand: state lives in store files, and components read it through a selector. | ## General | Configuration | What it checks | | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`commits`](/reference/configurations/commits/) | Checks commit messages for a conventional type, an optional project scope, a first line of 72 characters or fewer, and a wrapped body. | | [`dependencies`](/reference/configurations/dependencies/) | Checks for known advisories, one version per package, exact pins, one package manager, and a lockfile that matches its dependency file. | | [`docs`](/reference/configurations/docs/) | Documentation links that reach their files, anchors, and sites, and documented paths and commands that exist. Level `all` requires a README in every scope and a LICENSE at the root. | | [`duplication`](/reference/configurations/duplication/) | Reports copied code across every language a configuration claims. | | [`engineering`](/reference/configurations/engineering/) | Rules for working and writing code. The `[rules]` setting turns them on or off. | | [`files`](/reference/configurations/files/) | Data and settings files parse, match their schema, and use one layout. | | [`format`](/reference/configurations/format/) | Prettier and editorconfig-checker on every file. One `[format]` block sets the indentation, line length, quotes, and line endings for every formatter. | | [`gspot`](/reference/configurations/gspot/) | Checks gspot.toml, generated files, and suppression reasons. | | [`licenses`](/reference/configurations/licenses/) | Checks the license of each installed dependency against the allowed list. An allowed-package record with a reason accepts one package. | | [`naming`](/reference/configurations/naming/) | Checks every identifier, file, and folder for banned words, case, length, and word count. | | [`prose`](/reference/configurations/prose/) | Comments and documentation: clear dates, link text, and alternative text. Level `all` adds the complete gspot style and the upstream Vale packages. | | [`repository`](/reference/configurations/repository/) | Checks the files that Git tracks and their storage. | | [`secrets`](/reference/configurations/secrets/) | Checks environment files and examples, scans staged changes and pushed commits for secrets, and requires reasons for allowed values. | | [`security`](/reference/configurations/security/) | Unsafe code patterns in every file that a language configuration covers. | | [`spelling`](/reference/configurations/spelling/) | Spelling in every text file, with a reason for each allowed word. | | [`structure`](/reference/configurations/structure/) | Structure rules that no standard linter ships, at level `all`: lone files, shared name prefixes, file and folder clashes, long files, trivial functions, and environment reads outside the environment readers. |