OpenGrep

CodeRabbit runs OpenGrep to find security vulnerabilities and bugs across supported languages.

OpenGrep is a high-performance static code analysis engine for finding security vulnerabilities and bugs across many languages, and it supports existing Semgrep rule sets.

CodeRabbit runs OpenGrep v1.30.1.

Files

OpenGrep runs on files with the following extensions:

• C/C++: .c, .cpp, .cc, .cxx, .c++, .h, .hpp, .hh, .hxx, .h++
• C#: .cs
• Go: .go
• Java: .java
• JavaScript/TypeScript: .js, .jsx, .ts, .tsx
• Kotlin: .kt, .kts
• Python: .py
• Ruby: .rb
• Rust: .rs
• PHP: .php
• Scala: .scala
• Swift: .swift
• Terraform: .tf
• JSON: .json

Configuration

enabled · boolean · default: true

Enable OpenGrep: OpenGrep is a high-performance static code analysis engine for finding security vulnerabilities and bugs across 17+ languages.

.coderabbit.yaml

.coderabbit.yaml

reviews:
  tools:
    opengrep:
      enabled: true

Web UI

In your organization or repository settings, go to Reviews → Tools and turn the tool on or off with its toggle.

OpenGrep is Semgrep-compatible. CodeRabbit looks for a config file in this order:

• opengrep.yml
• opengrep.yaml
• opengrep.config.yml
• opengrep.config.yaml
• semgrep.yml
• semgrep.yaml
• semgrep.config.yml
• semgrep.config.yaml

Search starts with config files changed in the pull request (outside CI pipeline paths), then checks the repository root, and finally falls back to a broader recursive repository search. If no config file is found, CodeRabbit writes a temporary fallback config based on the selected review profile. If a repository’s OpenGrep or Semgrep-compatible configuration cannot be loaded or contains an invalid rule, CodeRabbit falls back to its built-in rules so the scan still produces findings. A valid repository configuration is used as-is and keeps precedence—CodeRabbit does not rewrite or remove it.

Profile behavior

When CodeRabbit generates a fallback configuration:

• Chill uses first-party, high-confidence security rules that report error-level findings.
• Assertive includes the Chill rules and adds broader warning-level security checks.

Security policy and restrictions

OpenGrep runs inside the CodeRabbit sandbox without network proxy access. Configuration files must be repository-local; remote configuration URLs are not supported. CodeRabbit escapes scan targets and prevents filenames from being interpreted as command-line options.

When we skip OpenGrep

CodeRabbit skips OpenGrep when:

• OpenGrep is disabled in your CodeRabbit configuration.
• No files in the pull request match the supported extensions.
• OpenGrep is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.
• A changed file is unavailable in the sandbox worktree, or is 8 MiB or larger.
• A changed filename contains a single quote.

Links

• OpenGrep GitHub
• Semgrep rule syntax (OpenGrep is compatible)