docs / security/rule-bundle-format
Rule bundle format
The on-wire format of the signed rule bundle.
Envelope
JSON object containing version, signed metadata, and an array of rule definitions. The signature covers the entire array; any modification to any rule invalidates it.
Rule definition
Each rule carries id, severity, category, engine, pattern, and description. Engine is one of regex or ast.
Verification
The proxy verifies the bundle signature on every fetch using a hard-coded Flux8Labs public key. There is no mechanism to load unsigned bundles in production builds.