[Semgrep](https://semgrep.dev/) is a static analysis tool designed to scan code

for security vulnerabilities and code quality issues.

[Semgrep](https://github.com/semgrep/semgrep) is an open-source static analysis tool designed to scan code for security vulnerabilities and code quality issues.

Semgrep uses a YAML style configuration file. By default we will automatically

Semgrep uses a YAML style configuration file. By default, we will automatically

use the following files if any are set in the root directory of your

repostitory.

repository.

-`semgrep.yml` or`semgrep.yaml`

-`semgrep.config.yml` or`semgrep.config.yaml`

project's`.coderabbit.yaml` file or setting the "Review → Tools → Semgrep →

Config File" field in CodeRabbit's settings page.

Due to licensing, CodeRabbit does not ship with the[community-created Semgrep rules](https://github.com/returntocorp/semgrep-rules), but you're free to use these in your own`semgrep.yml` config file.

Due to licensing, CodeRabbit does not ship with the[community-created Semgrep rules](https://github.com/returntocorp/semgrep-rules).

CodeRabbit will only run Semgrep if your repository contains a Semgrep config file. This config must use the default file names or you must define the path to this file in the`.coderabbit.yaml` or config UI.

CodeRabbit will only run Semgrep if your repository contains a Semgrep config file. This config must use the default file names, or you must define the path to this file in the`.coderabbit.yaml` or config UI.

Semgrep will run on the following files and extensions:

Semgrep will run on the following files types:

- C/C++

- C#

- Go

- Java

- JavaScript

- Kotlin

- Python

- TypeScript

- Ruby

- Rust

- JSX

- PHP

- Scala

- Swift

- Terraform

- JSON