# security

> Unsafe code patterns in every file that a language configuration covers.

Unsafe code patterns in every file that a language configuration covers. The [Security and secrets guide](/checks/security/) explains the setup.

## Checks

| Check                                                                       | Stage    | Level         | What it does                                                                                |
| --------------------------------------------------------------------------- | -------- | ------------- | ------------------------------------------------------------------------------------------- |
| [`security/semgrep`](/reference/checks/security/semgrep/)                   | `push`   | `recommended` | Runs the Semgrep packs of each configuration, and the repository rules, over changed files. |
| [`security/semgrep-registry`](/reference/checks/security/semgrep-registry/) | `manual` | `recommended` | Downloads and runs the public Semgrep packs in `tools.semgrep.registry_packs`.              |

## Settings

| Setting                                                                               | What it sets                                                                        |
| ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| [`tools.semgrep.registry_packs`](/reference/gspot-toml/#tools.semgrep.registry_packs) | The registry packs the manual registry check runs.                                  |
| [`tools.semgrep.rule_files`](/reference/gspot-toml/#tools.semgrep.rule_files)         | Rule files or folders of the repository that Semgrep runs beside the shipped packs. |

## Selected when

Always selected.

## Rules for coding agents

| Rule file                                                  | Installed when |
| ---------------------------------------------------------- | -------------- |
| `.gspot/configurations/general/security/rules/SECURITY.md` | Always         |

## Tools and versions

| Tool    | Version   |
| ------- | --------- |
| semgrep | `1.178.0` |