rules:
  - id: TODO
    mode: taint
    languages: [java]
    severity: ERROR
    message: "TODO"
    pattern-sources:
      - pattern: __TODO_SOURCE__(...)
    # TODO: add pattern-sinks — a taint rule with no sink fails to load.