{
  "schema_version": 1,
  "vulnerability": {
    "decision": "fail-all-severities",
    "severity_handling": "OSV does not guarantee a normalized severity, so every reported vulnerability is blocking unless an unexpired exception matches it.",
    "fail_severities": [
      "unknown",
      "low",
      "medium",
      "high",
      "critical"
    ],
    "max_fixed_suppression_days": 7,
    "max_unfixed_suppression_days": 90,
    "suppressions": []
  },
  "secret": {
    "decision": "fail-all-findings",
    "report_redaction_percent": 100,
    "max_suppression_days": 30,
    "suppressions": []
  },
  "license": {
    "decision": "exact-allow-list",
    "excluded_packages": [
      "obliteratus"
    ],
    "allowed_expressions": [
      "Apache 2.0 License",
      "Apache License 2.0",
      "Apache Software License",
      "Apache Software License; BSD License",
      "Apache-2.0",
      "Apache-2.0 AND Apache-2.0 WITH LLVM-exception AND BSD-2-Clause AND BSD-3-Clause AND BSL-1.0 AND MIT",
      "Apache-2.0 AND CNRI-Python",
      "Apache-2.0 AND MIT",
      "Apache-2.0 OR BSD-2-Clause",
      "BSD License",
      "BSD-2-Clause",
      "BSD-3-Clause",
      "BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0",
      "ISC License (ISCL)",
      "MIT",
      "MIT License",
      "MIT-CMU",
      "MPL-2.0 AND (Apache-2.0 OR MIT)",
      "MPL-2.0 AND MIT",
      "Mozilla Public License 2.0 (MPL 2.0)",
      "PSF-2.0",
      "Python Software Foundation License"
    ]
  }
}