1Your organisation
The pack id becomes the prefix of your rule ids (e.g. ACME-POL-01).
2Minimum compliance level
Every product using this pack is assessed at least at this level, even if its manifest asks for less.
3No-gos
Rules you never break. A no-go always applies and blocks the build at any level, even on medium-confidence signals.
4Forbidden packages and phrases
One per line. Packages are matched in package.json, requirements, Podfile, Gradle and pubspec. Phrases are matched case-insensitively in code and copy files.
5Records you require
Features that need a decision record (with a named approver) before release, linked in each product's csef.yaml.
6Your own rules
Requirements specific to your organisation. Add a regular expression if the scanner can detect a breach in code.