reference > Rule syntax

message

See also

severity, rules, $X

The text reported with each finding of the rule. Every search and taint rule must have a message; a rule without one is rejected with Missing required field message. The text output prints the message under the rule id, and the JSON output contains it as the message of each result.

A metavariable in the message, such as $ALG, is replaced by the code that the metavariable matched in the finding.

## Examples

### Naming the matched code

rules:  - id: weak-hash    pattern: hashlib.$ALG(...)    message: $ALG is a weak hash for passwords    languages: [python]    severity: WARNING

import hashlibhashlib.md5(password)

$ opengrep scan -q --config rule.yaml app.py
app.py

  warn  weak-hash
  md5 is a weak hash for passwords

     3: hashlib.md5(password)