HorizonAnalysisDenylist

Known-bad dependencies plus known-benign (rule, path) pairs. Kept in a separate column from analysis-settings on purpose: this is a security list and must not be editable as a side effect of tuning a numeric threshold.

{
    "bad_packages": [
        "string"
    ],
    "benign": [
        {
            "rule": "document-cookie",
            "path": "node_modules/loglevel/"
        }
    ]
}