scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-08-28 05:25:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 36
litellm/.semgrep/rules/README.md
Alexsander Hamir f32322cd41
chore: improve Semgrep rules documentation and organization (#20978) 
- Add organizing rules (language/domain structure, naming, metadata)
- Require all rules to fail CI (severity: ERROR, no warn-only)
- Move unbounded-memory.yml to python/reliability/ per structure
- Enhance unbounded-memory rule metadata (tags, confidence, source)
2026-02-11 09:39:44 -08:00

1,005 B
Raw Blame History

Custom Semgrep Rules

All .yml files under .semgrep/rules/ run in CI (CircleCI semgrep job).

Add a Rule

  • Add a .yml file under .semgrep/rules/<language>/<domain>/

Rule syntax →

Organizing Rules

Structure: language → domain

.semgrep/rules/<language>/<domain>/<rule-name>.yml

Examples:

  • python/security/unsafe-yaml-load.yml
  • python/reliability/missing-timeout-http.yml
  • python/performance/blocking-io-in-async.yml

Rule metadata

Match tags to the folder for consistent filtering:

metadata:
  tags: [python, security]

Severity expectations

All rules must fail CI on findings. No warn-only rules.

  • Use severity: ERROR in rule metadata
  • If a rule is noisy → refine until low false positives before adding

Run Locally

semgrep scan --config .semgrep/rules . --error

With Semgrep registry:

semgrep scan --config auto --config .semgrep/rules .