Skip to main content

Rules Overview

Rules are the main control mechanism for Dam Secure. Rules represent plain-language security requirements that Dam Secure evaluates against your code, such as "Encrypt PII at rest using field-level encryption."

Each rule belongs to a category (e.g. Cryptography & Key Management) and is mapped to the projects where it applies.

When a rule is violated, Dam Secure raises an Issue containing the offending code, an explanation, and a severity rating, so engineers can see exactly what failed and why.

When you create a rule, it sits at the organisation level. You then decide which projects it applies to. That means the same backend-specific SQL rule can run on your two API services without firing on your React frontend.

Team Rules list showing where each rule is used and its applicability.

Where rules are used​

You can choose one or more products for each team rule:

  • Secure Spec reviews coding-agent plans before implementation begins.
  • PR Scan reviews changes in pull requests and merge requests.
  • Full Scan reviews the repository more broadly.

For Secure Spec, you can also choose how the rule is enforced:

  • Block requires the coding agent to update a plan that does not satisfy the rule before implementation continues.
  • Warn gives the coding agent guidance but allows implementation to continue.

The Block or Warn choice appears only when the rule is used in Secure Spec. It does not affect PR Scan or Full Scan.

Rule editor showing the products where a rule can be used.