OpenGrep

CodeRabbit runs OpenGrep to find security vulnerabilities and bugs across supported languages.

OpenGrep is a high-performance static code analysis engine for finding security vulnerabilities and bugs across many languages, and it supports existing Semgrep rule sets. CodeRabbit runs OpenGrep version 1.27.1.

Files

OpenGrep runs on files with the following extensions:

• C/C++: .c, .cpp, .cc, .cxx, .c++, .h, .hpp, .hh, .hxx, .h++
• C#: .cs
• Go: .go
• Java: .java
• JavaScript/TypeScript: .js, .jsx, .ts, .tsx
• Kotlin: .kt, .kts
• Python: .py
• Ruby: .rb
• Rust: .rs
• PHP: .php
• Scala: .scala
• Swift: .swift
• Terraform: .tf
• JSON: .json

Configuration

OpenGrep is enabled by default. Enable or disable it with .coderabbit.yaml or the CodeRabbit web UI:

.coderabbit.yaml

.coderabbit.yaml

reviews:
  tools:
    opengrep:
      enabled: true

Web UI

Go to Reviews → Tools → OpenGrep in your organization or repository settings and toggle OpenGrep on or off.

OpenGrep is Semgrep-compatible. CodeRabbit looks for a config file in this order:

• opengrep.yml
• opengrep.yaml
• opengrep.config.yml
• opengrep.config.yaml
• semgrep.yml
• semgrep.yaml
• semgrep.config.yml
• semgrep.config.yaml

Search starts in the repository root and in PR-changed files, then falls back to a broader repository search. If no config file is found, CodeRabbit writes a temporary fallback config based on the selected review profile. If a repository’s OpenGrep or Semgrep-compatible configuration cannot be loaded or contains an invalid rule, CodeRabbit falls back to its built-in rules so the scan still produces findings. A valid repository configuration is used as-is and keeps precedence—CodeRabbit does not rewrite or remove it.

Profile behavior

When CodeRabbit generates a fallback configuration:

• Chill uses first-party, high-confidence security rules that report error-level findings.
• Assertive includes the Chill rules and adds broader warning-level security checks.

Security policy and restrictions

OpenGrep runs inside the CodeRabbit sandbox without network proxy access. Configuration files must be repository-local; remote configuration URLs are not supported. CodeRabbit escapes scan targets and prevents filenames from being interpreted as command-line options.

When we skip OpenGrep

CodeRabbit skips OpenGrep when:

• OpenGrep is disabled in your CodeRabbit configuration.
• No files in the pull request match the supported extensions.
• OpenGrep is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.
• A changed file is unavailable in the sandbox worktree, or is 8 MiB or larger.

Links

• OpenGrep GitHub
• Semgrep rule syntax (OpenGrep is compatible)