{
  "version": 1,
  "refuses": [
    "exploit steps",
    "payloads",
    "proof of concept attacks"
  ],
  "order": [
    "secrets",
    "authorization",
    "injection",
    "client-trusted decisions",
    "server-side requests",
    "auth defaults",
    "prompt boundaries"
  ],
  "severities": [
    "high",
    "medium",
    "low"
  ],
  "requiresEvidenceQuote": true
}