- name: profile-payload-allowlist
  where: "src/profile-command.ts"
  ensure: >-
    updateProfile must project only displayName and timezone into its HTTP payload, rather than spreading all form fields.