Exploited tools Semgrep Loads default .semgrep.yml rulebase from file then from folder. if using folder configuration file would override it. Fix just use config flag -c to force specific configuration file