Skip to main content
Metadata only — never the rule body. A rule body is unbounded, attacker-controlled prose from content the user has not accepted, so it is read from disk through the existing rules UI after installing, never put on this wire.