rules:
  - id: org.yourorg.java.bypass-auth-dev-flag
    languages: [java]
    message: "Auth bypass when environment = dev detected. Remove bypass logic from code."
    severity: ERROR
    pattern: |
      if ($ENV.equals("dev")) { return true; }