rules:
  - id: vulnerable-content-provider
    severity: WARNING
    languages: [xml]
    message: "ContentProvider exported without permission."
    metadata:
      authors:
        - Guerric ELOI (FuzzingLabs)
      category: component
      area: manifest
      verification-level: [L1]
    paths:
      include:
        - "**/AndroidManifest.xml"
    pattern: |
      <provider android:exported="true"