# deny for all go files
      AllGoFiles:
        files:
          - $all
        deny:
          - pkg: golang.org/x/net/http2/h2c
            desc: "h2c.NewHandler is unsafe; use wrapper istio.io/istio/pkg/h2c"
          - pkg: github.com/golang/protobuf/jsonpb
            desc: "don't use the jsonpb package directly; use util/protomarshal instead"