{
  "focus": ["security", "sql-injection", "auth", "path-traversal"],
  "exclude_paths": ["tests/fixtures/**"],
  "languages": ["python"],
  "instructions": "House rules: all SQL must be parameterised — flag any query built by string concatenation or f-string as critical. Secrets and tokens must be compared with hmac.compare_digest, never ==. Any filesystem path derived from user input must be resolved and checked to stay inside its intended root. Public handlers in app/api.py must have an explicit authorisation check, not merely an authentication check."
}