Where Does Semgrep Read Rules From?
Semgrep reads .semgrep.yml in the repo for local rules, with registry rulesets referenced by name.
Last updated
Semgrep composes rules from two sources. Local rules live in .semgrep.yml at the repo root for project specific patterns. Shared rulesets pull from the registry by name in CI config or command flags.
Engine settings and tokens sit in user config rather than the repo. Metrics and findings cache under the user cache folder between runs. Keep local rules tight and let the registry cover common frameworks.
Where Semgrep stores this, by platform
[Repo]/.semgrep.yml
Project rules beside code with registry names referenced in CI. User tokens live in ~/.settings instead. Flags override per run.
[Repo]/.semgrep.yml
Same root file on Mac. Editor plugins read it through the workspace. Registry rulesets need network on first fetch.
[Repo]\.semgrep.yml
Same file on Windows. Rule syntax versions with the engine, so pin versions in CI. Exact config filename variants resolve by release.
Frequently asked questions
How do I test a new Semgrep rule?
Run semgrep against the rule file and a target path directly. Iterate on matches before committing. Promote passing rules into .semgrep.yml.
Where is the Semgrep login stored?
In user settings outside the repo after semgrep login. Repos stay shareable without tokens. CI uses tokens from secrets instead.
Notice an outdated path? Let us know.