- name: unknown-mutation-fields-rejected
  where: "src/main.ts"
  ensure: >-
    The global ValidationPipe must enable both whitelist and forbidNonWhitelisted to reject unknown mutation fields instead of silently accepting or stripping them.