This repository runs Semgrep on every pull request, on push to main, and on a daily schedule. The configuration lives in:

• .github/workflows/semgrep.yml — CI workflow
• .semgrep/turnkey-rules.yml — Turnkey-specific rules
• .semgrepignore — paths excluded from scanning

brew install semgrep   # or: pip install semgrep
semgrep scan --config p/security-audit --config p/secrets --config .semgrep/

When you fix a security bug, add a Semgrep rule in .semgrep/ so it cannot regress. See the Semgrep rule syntax docs.