.semgrep.yaml

# Semgrep configuration documenting justified exceptions for TNFR.
exclude:
  rules:
    - id: python.lang.security.audit.non-literal-import.non-literal-import
      justification: >-
        Dynamic imports only load TNFR-maintained helpers and operator registries.
        Module names originate from static manifests or package discovery, not user input.
    - id: python.lang.security.deserialization.pickle.avoid-pickle
      justification: >-
        Pickle is invoked solely to verify multiprocessing compatibility for in-memory
        graph state; no untrusted payloads are deserialised.
    - id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1
      justification: >-
        SHA1 digests are used for deterministic topology fingerprints in telemetry and
        caches and are not relied upon for security guarantees.