# Every pull request requires review from the Qwalora Security Engineering
# Board before merge to main. Branch protection on main must require:
#   - the test-and-validate check to pass
#   - at least one CODEOWNERS review
#   - no direct pushes to main (PR only)
*                           @qwalora/security-eng-board

/app/api/                   @qwalora/security-eng-board
/.github/workflows/         @qwalora/security-eng-board
/infra/                     @qwalora/security-eng-board
