diff --git a/docs/configuration/_category_.json b/docs/configuration/_category_.json
new file mode 100644
index 000000000..61a128126
--- /dev/null
+++ b/docs/configuration/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Configuration",
+  "position": 999
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json
new file mode 100644
index 000000000..6cd81f819
--- /dev/null
+++ b/docs/configuration/initiatives/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Reference: Policies and Configuration Guide",
+  "position": 999
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md
new file mode 100644
index 000000000..173fb9a8e
--- /dev/null
+++ b/docs/configuration/initiatives/bp1.md
@@ -0,0 +1,251 @@
+---
+sidebar_label: Blueprint for Secure Pipelines
+title: Blueprint for Secure Pipelines
+---  
+# Blueprint for Secure Pipelines  
+**Type:** Initiative  
+**ID:** `blueprint-securesoftwarepipeline`  
+**Version:** `1.0.0`  
+**Bundle-Version:** `v2`  
+**Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/bp1.yaml)  
+**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline  
+
+Blueprint for secure pipelines - Gitlab
+
+## **Description**
+
+This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[CT-1] Restrict administrative access to CI/CD tools](#ct-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. |
+| [[CT-2] Only accept commits signed with a developer GPG key](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. |
+| [[CT-3] Automation access keys expire automatically](#ct-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. |
+| [[CT-4] Reduce automation access to read-only](#ct-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. |
+| [[CT-6] Any critical or high severity vulnerability breaks the build](#ct-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. |
+| [[CT-8] Validate artifact digest](#ct-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. |
+| [[CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ct-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. |
+| [[CT-11] Available container images don’t have any high or critical vulnerabilities](#ct-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. |
+| [[CT-12] Validate artifact signatures and digests](#ct-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. |
+| [[CT-13] Scan deployed images in production](#ct-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | True |
+
+---
+
+# Detailed Controls
+
+## [CT-1] Restrict administrative access to CI/CD tools
+
+Restrict administrative access to CI/CD tools
+
+
+### Mitigation  
+Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes.
+
+### **Description**
+
+It's important to ensure that only authorized persons can make administrative changes to the CI/CD system. If an unauthorized person gains access, they could modify pipeline definitions and subvert other controls.
+
+Both host and application-layer access to CI/CD tools should be protected with multi-factor authentication.
+
+> :skull: Instead of manipulating code, attackers may target the CI/CD pipeline itself, leading to undetected breaches and long-term damage.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [gitlab-org-max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. |
+
+## [CT-2] Only accept commits signed with a developer GPG key
+
+The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab
+
+
+### Mitigation  
+Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications.
+
+### **Description**
+
+Unsigned code commits are difficult to trace and pose a risk to the integrity of the codebase. Requiring commits to be signed with a developer GPG key ensures nonrepudiation and increases the burden on attackers.
+
+> :skull: Attackers may exploit unsigned commits by stealing credentials or infecting developer machines, allowing them to inject malicious code.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [gitlab-project-disallow-unsigned-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. |
+| [gitlab-project-signed-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. |
+
+## [CT-3] Automation access keys expire automatically
+
+Automation access keys expire automatically
+
+
+### Mitigation  
+Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited.
+
+### **Description**
+
+Ensuring that access keys used by automation expire periodically reduces the risk when keys are compromised.
+
+> :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [gitlab-org-token-excessive-lifespan](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. |
+
+## [CT-4] Reduce automation access to read-only
+
+Reduce automation access to read-only
+
+
+### Mitigation  
+Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage.
+
+### **Description**
+
+CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts.
+
+> :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [gitlab-org-disallowed-token-scope](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. |
+
+## [CT-6] Any critical or high severity vulnerability breaks the build
+
+Any critical or high severity vulnerability breaks the build
+
+
+### Mitigation  
+Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation.
+
+### **Description**
+
+Supply chain attacks may introduce code vulnerabilities. Using SAST and SCA to identify serious security issues and failing the build prevents insecure code from being merged.
+
+> NOTE: This control complements Control-4 by ensuring no critical vulnerabilities are ignored.
+
+Early detection reduces remediation costs, but also requires a well-defined vulnerability exception process.
+
+> :skull: Vulnerabilities, if undetected, can proliferate quickly and cause widespread damage.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+
+## [CT-8] Validate artifact digest
+
+Validate artifact digest
+
+
+### Mitigation  
+Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity.
+
+### **Description**
+
+Before deployment, an artifact’s digest is checked against the expected value to confirm it has not been compromised.
+
+> :skull: Attackers often attempt to alter artifacts; validating the digest helps ensure integrity.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | [Require SBOM Existence](rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. |
+
+## [CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged
+
+Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged
+
+
+### Mitigation  
+Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged.
+
+### **Description**
+
+Requiring multiple code reviews and successful tests helps ensure that no changes are merged without proper oversight.
+
+> :skull: Without proper reviews, attackers can insert malicious changes; this control mitigates that risk.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [gitlab-project-merge-approval](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. |
+
+## [CT-11] Available container images don’t have any high or critical vulnerabilities
+
+Available container images don’t have any high or critical vulnerabilities
+
+
+### Mitigation  
+Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed.
+
+### **Description**
+
+Container images must be scanned before deployment to prevent the inclusion of images with serious vulnerabilities.
+
+> :skull: Vulnerable containers can be a major attack vector; this control helps prevent their use.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+
+## [CT-12] Validate artifact signatures and digests
+
+Validate artifact signatures and digests
+
+
+### Mitigation  
+Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering.
+
+### **Description**
+
+Validating the signature and digest of an artifact ensures that it has not been altered between testing and deployment.
+
+> :skull: This control helps prevent the deployment of artifacts that may have been modified by attackers.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+
+## [CT-13] Scan deployed images in production
+
+Scan deployed images in production
+
+
+### Mitigation  
+Continuously monitor and scan production images to ensure ongoing compliance with security standards.
+
+### **Description**
+
+Production images should be validated to ensure that controls enforced during earlier stages continue to be effective in production.
+
+> :skull: Ongoing monitoring helps detect any security issues that may emerge post-deployment.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+| [sbom-disallow-dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. |
+| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md
new file mode 100644
index 000000000..e1714b601
--- /dev/null
+++ b/docs/configuration/initiatives/index.md
@@ -0,0 +1,314 @@
+# Documentation Index
+
+## Initiatives
+
+<!-- START TABLE -->
+| Name | Description |
+|------|-------------|
+| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab |
+| [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 |
+| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include:   - A Software Bill of Materials (SBOM) to ensure component inventory and traceability,     addressing requirements from SR-4 and CM-8.   - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. |
+| [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative |
+| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in  NIST SP 800-190. It ensures that containerized applications follow  security best practices, including vulnerability scanning, trusted  image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls  throughout the software development lifecycle (SDLC), providing real-time  feedback to developers and enforcement in CI/CD pipelines. |
+| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 |
+
+## Rules
+
+### SBOM
+**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. |
+| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. |
+| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. |
+| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. |
+| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | Verify the SBOM exists as evidence. |
+| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. |
+| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. |
+
+### Image SBOM
+**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. |
+| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. |
+| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. |
+| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. |
+| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. |
+| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. |
+| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. |
+| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. |
+| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS |
+| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. |
+| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. |
+| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. |
+| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. |
+| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. |
+| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. |
+| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-users) | Verify specific users are not allowed in an SBOM. |
+| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies. |
+| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. |
+| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. |
+| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. |
+| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. |
+| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. |
+
+### Git SBOM
+**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. |
+| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. |
+| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. |
+| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. |
+| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. |
+
+### SARIF Evidence
+**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. |
+| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. |
+| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. |
+| [Verify Artifact Signature in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. |
+| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. |
+| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. |
+| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. |
+| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. |
+| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. |
+| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report |
+| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold.  |
+| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. |
+| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. |
+| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold |
+
+### Generic Statement
+**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists |
+| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. |
+| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. |
+
+### Github Organization Discovery Evidence
+**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. |
+| [Verify `secret_scanning_push_protection` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. |
+| [Verify `secret_scanning_validity_checks_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. |
+| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. |
+| [Verify `secret_scanning` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. |
+| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. |
+| [Verify `advanced_security_enabled_for_new_repositories` setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security` is enabled for new repositories in the GitHub organization. |
+| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. |
+| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. |
+| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. |
+| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. |
+| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. |
+| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. |
+| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. |
+| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. |
+| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. |
+| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). |
+| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. |
+| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. |
+| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. |
+| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. |
+
+### Github Repository Discovery Evidence
+**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. |
+| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. |
+| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. |
+| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. |
+| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. |
+| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. |
+| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. |
+| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. |
+| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. |
+| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. |
+| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. |
+| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. |
+| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. |
+| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. |
+| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. |
+| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. |
+
+### Gitlab Organization Discovery Evidence
+**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. |
+| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. |
+| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. |
+| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. |
+| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. |
+| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. |
+| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. |
+| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. |
+| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. |
+| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. |
+| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. |
+
+### Gitlab Project Discovery Evidence
+**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. |
+| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. |
+| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. |
+| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. |
+| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. |
+| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. |
+| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. |
+| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. |
+| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. |
+| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. |
+| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. |
+| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. |
+| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. |
+| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. |
+| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. |
+| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. |
+| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. |
+| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. |
+| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. |
+| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. |
+| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. |
+| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. |
+| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. |
+| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. |
+| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. |
+| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. |
+| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. |
+| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. |
+| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. |
+| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. |
+| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. |
+| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. |
+| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. |
+| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. |
+| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. |
+| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. |
+| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. |
+| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. |
+
+### K8s Namespace Discovery Evidence
+**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. |
+| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. |
+| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. |
+| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. |
+| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. |
+| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. |
+
+### K8s Pod Discovery Evidence
+**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. |
+| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. |
+| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. |
+
+### Bitbucket Project Discovery Evidence
+**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. |
+| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. |
+| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. |
+| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. |
+
+### Bitbucket Repository Discovery Evidence
+**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. |
+| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. |
+| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. |
+
+### Bitbucket Workspace Discovery Evidence
+**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. |
+| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. |
+
+### Discovery Evidence
+**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. |
+| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. |
+| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. |
+
+### Dockerhub Project Discovery Evidence
+**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. |
+| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. |
+
+### Jenkins Instance Discovery Evidence
+**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. |
+| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. |
+
+### SLSA Provenance
+**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. |
+| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. |
+| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. |
+| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. |
+| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. |
+| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. |
+| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. |
+
+### Statement
+**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. |
+| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules |
+| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. |
+| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository |
+| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image |
+| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface |
+| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM |
+| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private |
+| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins |
+| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code |
+| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository |
+| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. |
+| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. |
+| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. |
+| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. |
diff --git a/docs/configuration/initiatives/rules/_category_.json b/docs/configuration/initiatives/rules/_category_.json
new file mode 100644
index 000000000..46c5e5953
--- /dev/null
+++ b/docs/configuration/initiatives/rules/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Rule Configuration",
+  "position": 999
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/api/_category_.json b/docs/configuration/initiatives/rules/api/_category_.json
new file mode 100644
index 000000000..01fdec181
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Scribe API",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md
new file mode 100644
index 000000000..013c9e460
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md
@@ -0,0 +1,41 @@
+---
+sidebar_label: Verify No Critical or High Vulnerabilities in Product
+title: Verify No Critical or High Vulnerabilities in Product
+---  
+# Verify No Critical or High Vulnerabilities in Product  
+**Type:** Rule  
+**ID:** `scribe-cve-product`  
+**Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve-product.yaml)  
+**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego)  
+**Labels:** SCA, Blueprint, Scribe  
+
+Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product.
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-cve-product@v2
+```
+
+## Mitigation  
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description  
+This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API.
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| cve | array | True | List of CVEs to check against the product components. |
+
diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md
new file mode 100644
index 000000000..2658ceca7
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Verify No Critical or High Vulnerabilities
+title: Verify No Critical or High Vulnerabilities
+---  
+# Verify No Critical or High Vulnerabilities  
+**Type:** Rule  
+**ID:** `scribe-cve`  
+**Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml)  
+**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego)  
+**Labels:** SCA, Blueprint, Scribe  
+
+Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.).
+
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-cve@v2
+with:
+  superset:
+    cve:
+      max: 0
+      severity: 6
+```
+
+## Mitigation  
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description  
+This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| superset | object | False | The superset of CVEs to check for, including the following format [cve: [max: int, severity: int]] |
+
diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md
new file mode 100644
index 000000000..58091e9d7
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: Scribe Published Policy
+title: Scribe Published Policy
+---  
+# Scribe Published Policy  
+**Type:** Rule  
+**ID:** `scribe-published-policy`  
+**Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.yaml)  
+**Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.rego)  
+**Labels:** Scribe  
+
+Verify image Scribe Publish flag is set for container image.
+
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-published@v2
+```
+
+## Mitigation  
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description  
+This rule ensures that the product is published only after all critical or high severity vulnerabilities are addressed.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| superset | `{'published': None}` |
+
diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md
new file mode 100644
index 000000000..77616e83a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api.md
@@ -0,0 +1,40 @@
+---
+sidebar_label: Apply Scribe Template Policy
+title: Apply Scribe Template Policy
+---  
+# Apply Scribe Template Policy  
+**Type:** Rule  
+**ID:** `scribe-template`  
+**Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml)  
+**Labels:** Scribe  
+
+Verify XX using the Scribe API template rule.
+
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: api/scribe-api@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| predicate_type | https://cyclonedx.org/bom |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| superset | None |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/_category_.json b/docs/configuration/initiatives/rules/bitbucket/_category_.json
new file mode 100644
index 000000000..e6515f2ae
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Bitbucket",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/_category_.json b/docs/configuration/initiatives/rules/bitbucket/project/_category_.json
new file mode 100644
index 000000000..a88c9e5b1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Project",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md
new file mode 100644
index 000000000..33a2bbf74
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Project Admins
+title: Allowed Project Admins
+---  
+# Allowed Project Admins  
+**Type:** Rule  
+**ID:** `bb-project-allowed-project-admins`  
+**Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.yaml)  
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.rego)  
+
+Verify only users specified in the Allowed List have admin privileges in the Bitbucket project.
+
+:::note 
+This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/allow-admins@v2
+with:
+  allowed_admins:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have admin privileges in the Bitbucket project to reduce the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket project.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket project. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md
new file mode 100644
index 000000000..538e7c39d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Project Users
+title: Allowed Project Users
+---  
+# Allowed Project Users  
+**Type:** Rule  
+**ID:** `bb-project-allowed-project-users`  
+**Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.yaml)  
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.rego)  
+
+Verify only users specified in the Allowed List have user access to the Bitbucket project.
+
+:::note 
+This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/allow-users@v2
+with:
+  allowed_users:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have user access to the Bitbucket project to reduce the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have user access to the Bitbucket project.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that only users in the Allowed List have user access.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of users allowed to have user access to the Bitbucket project. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md
new file mode 100644
index 000000000..68b1d2eb3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Prevent Credential Exposure
+title: Prevent Credential Exposure
+---  
+# Prevent Credential Exposure  
+**Type:** Rule  
+**ID:** `bb-project-exposed-credentials`  
+**Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.yaml)  
+**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.rego)  
+**Labels:** Bitbucket, Project  
+
+Verify access to the Bitbucket project is blocked if exposed credentials are detected.
+
+:::note 
+This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/exposed-credentials@v2
+```
+
+## Mitigation  
+Ensure that access to the Bitbucket project is blocked if exposed credentials are detected to prevent unauthorized access.
+
+
+## Description  
+This rule ensures that access to the Bitbucket project is blocked if exposed credentials are detected.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that access is blocked if exposed credentials are detected.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md
new file mode 100644
index 000000000..2cc57054e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md
@@ -0,0 +1,58 @@
+---
+sidebar_label: Prevent Long-Lived Tokens
+title: Prevent Long-Lived Tokens
+---  
+# Prevent Long-Lived Tokens  
+**Type:** Rule  
+**ID:** `bb-project-long-live-tokens`  
+**Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.yaml)  
+**Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.rego)  
+**Labels:** Bitbucket, Project  
+
+Verify Bitbucket API tokens expire before the maximum time to live.
+
+:::note 
+This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/long-live-tokens@v2
+with:
+  max_days: 30
+```
+
+## Mitigation  
+Ensure that Bitbucket API tokens expire before the maximum time to live to reduce the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that Bitbucket API tokens expire before the maximum time to live.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that tokens expire before the maximum time to live.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=project<br/>- platform=bitbucket<br/>- platform_instance=bitbucket_dc |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | number | False | Maximum number of days a token can be valid. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/_category_.json b/docs/configuration/initiatives/rules/bitbucket/repository/_category_.json
new file mode 100644
index 000000000..e93f68442
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/repository/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Repository",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md
new file mode 100644
index 000000000..b68c8403e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Repository Admins
+title: Allowed Repository Admins
+---  
+# Allowed Repository Admins  
+**Type:** Rule  
+**ID:** `bb-repo-allowed-repository-admins`  
+**Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.yaml)  
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.rego)  
+**Labels:** Bitbucket, Repository  
+
+Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository.
+
+:::note 
+This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/repository/allow-admins@v2
+with:
+  allowed_admins:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have admin privileges in the Bitbucket repository to reduce the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket repository.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket repository.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=repository |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket repository. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md
new file mode 100644
index 000000000..be9a18261
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Repository Users
+title: Allowed Repository Users
+---  
+# Allowed Repository Users  
+**Type:** Rule  
+**ID:** `bb-repo-allowed-repository-users`  
+**Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.yaml)  
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.rego)  
+**Labels:** Bitbucket, Repository  
+
+Verify only users specified in the Allowed List have user access to the Bitbucket repository.
+
+:::note 
+This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/repository/allow-users@v2
+with:
+  allowed_users:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have user access to the Bitbucket repository to reduce the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have user access to the Bitbucket repository.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket repository.
+2. Verifies that only users in the Allowed List have user access.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=repository |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of users allowed to have user access to the Bitbucket repository. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md
new file mode 100644
index 000000000..d4f3b7847
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify Default Branch Protection Setting Is Configured
+title: Verify Default Branch Protection Setting Is Configured
+---  
+# Verify Default Branch Protection Setting Is Configured  
+**Type:** Rule  
+**ID:** `bb-repo-branch-protection`  
+**Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.yaml)  
+**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.rego)  
+**Labels:** Bitbucket, Repository  
+
+Verify the default branch protection is enabled in the Bitbucket repository.
+
+:::note 
+This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/repository/branch-protection@v2
+with:
+  branches:
+    - "main"
+```
+
+## Mitigation  
+Ensures that the default branch is protected, reducing the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that the default branch protection is enabled in the Bitbucket repository.
+It performs the following steps:
+
+1. Checks the repository settings for default branch protection configuration.
+2. Verifies that the configuration matches the expected settings.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=repository |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branches | array | False | List of branches to verify default branch protection. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/_category_.json b/docs/configuration/initiatives/rules/bitbucket/workspace/_category_.json
new file mode 100644
index 000000000..ed893c2ea
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/workspace/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Workspace",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md
new file mode 100644
index 000000000..9bfe4cf30
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Workspace Admins
+title: Allowed Workspace Admins
+---  
+# Allowed Workspace Admins  
+**Type:** Rule  
+**ID:** `bb-workspace-allowed-workspace-admins`  
+**Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.yaml)  
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.rego)  
+**Labels:** Bitbucket, Workspace  
+
+Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace.
+
+:::note 
+This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/workspace/allow-admins@v2
+with:
+  allowed_admins:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have admin privileges in the Bitbucket workspace to reduce the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket workspace.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket workspace.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket workspace resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=workspace |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket workspace. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md
new file mode 100644
index 000000000..9b657f460
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Workspace Users
+title: Allowed Workspace Users
+---  
+# Allowed Workspace Users  
+**Type:** Rule  
+**ID:** `bb-workspace-allowed-workspace-users`  
+**Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.yaml)  
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.rego)  
+**Labels:** Bitbucket, Workspace  
+
+Verify only users specified in the Allowed List have user access to the Bitbucket workspace.
+
+:::note 
+This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/workspace/allow-users@v2
+with:
+  allowed_users:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have user access to the Bitbucket workspace to reduce the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have user access to the Bitbucket workspace.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket workspace.
+2. Verifies that only users in the Allowed List have user access.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket workspace resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=workspace |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of users allowed to have user access to the Bitbucket workspace. |
+
diff --git a/docs/configuration/initiatives/rules/dockerhub/_category_.json b/docs/configuration/initiatives/rules/dockerhub/_category_.json
new file mode 100644
index 000000000..7c6237a25
--- /dev/null
+++ b/docs/configuration/initiatives/rules/dockerhub/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Dockerhub",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md
new file mode 100644
index 000000000..676debc6a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md
@@ -0,0 +1,53 @@
+---
+sidebar_label: Verify DockerHub Tokens are Active
+title: Verify DockerHub Tokens are Active
+---  
+# Verify DockerHub Tokens are Active  
+**Type:** Rule  
+**ID:** `dockerhub-token-expiration`  
+**Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.yaml)  
+**Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.rego)  
+**Labels:** Dockerhub  
+
+Verify that all discovered Dockerhub tokens are set to Active in Dockerhub.
+
+:::note 
+This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: dockerhub/token-expiration@v2
+```
+
+## Mitigation  
+Ensure all Dockerhub tokens are set to Active status to prevent unauthorized access.
+
+
+## Description  
+This rule verifies that all discovered Dockerhub tokens are set to Active in Dockerhub.
+It performs the following steps:
+
+1. Iterates over the Dockerhub tokens in the project.
+2. Checks each token's status against the Active status.
+   - If a token's status is not Active, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=project<br/>- platform=dockerhub |
+
diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md
new file mode 100644
index 000000000..89483d5ef
--- /dev/null
+++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md
@@ -0,0 +1,48 @@
+---
+sidebar_label: Verify no unused Dockerhub
+title: Verify no unused Dockerhub
+---  
+# Verify no unused Dockerhub  
+**Type:** Rule  
+**ID:** `dockerhub-token-not-used`  
+**Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.yaml)  
+**Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.rego)  
+**Labels:** Dockerhub  
+
+Verify that there are no unused Dockerhub.
+
+:::note 
+This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: dockerhub/token-not-used@v2
+```
+
+## Description  
+This rule verifies that there are no unused Dockerhub.
+It performs the following steps:
+
+1. Iterates over the Dockerhub tokens in the project.
+2. Checks each token's last_used is null , the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=project<br/>- platform=dockerhub |
+
diff --git a/docs/configuration/initiatives/rules/generic/_category_.json b/docs/configuration/initiatives/rules/generic/_category_.json
new file mode 100644
index 000000000..ab9d35851
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Generic",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md
new file mode 100644
index 000000000..5c5e18bff
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md
@@ -0,0 +1,40 @@
+---
+sidebar_label: Generic Artifact Signed
+title: Generic Artifact Signed
+---  
+# Generic Artifact Signed  
+**Type:** Rule  
+**ID:** `generic-artifact-signed`  
+**Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.yaml)  
+**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.rego)  
+**Labels:** 3rd-party  
+
+Verify required evidence is signed.
+
+:::note 
+This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS** required by default.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: generic/artifact-signed@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | True |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 |
+
diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md
new file mode 100644
index 000000000..35e2b42d6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md
@@ -0,0 +1,39 @@
+---
+sidebar_label: Required Generic Evidence Exists
+title: Required Generic Evidence Exists
+---  
+# Required Generic Evidence Exists  
+**Type:** Rule  
+**ID:** `generic-required-evidence`  
+**Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.yaml)  
+**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.rego)  
+**Labels:** 3rd-party  
+
+Verify required evidence exists.
+
+:::note 
+This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: generic/evidence-exists@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 |
+
diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md
new file mode 100644
index 000000000..61c4f1af0
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: K8s Jailbreak
+title: K8s Jailbreak
+---  
+# K8s Jailbreak  
+**Type:** Rule  
+**ID:** `k8s-jailbreak`  
+**Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.yaml)  
+**Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.rego)  
+**Labels:** K8s  
+
+Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: generic/k8s-jailbreak@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| target_type | data |
+
diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md
new file mode 100644
index 000000000..1cfdda67b
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md
@@ -0,0 +1,35 @@
+---
+sidebar_label: Required Trivy Evidence Exists
+title: Required Trivy Evidence Exists
+---  
+# Required Trivy Evidence Exists  
+**Type:** Rule  
+**ID:** `required-trivy-evidence`  
+**Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/trivy-exists.yaml)  
+**Labels:** 3rd-party  
+
+Verify required Trivy evidence exists
+
+:::note 
+This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: generic/trivy-exists@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | https://aquasecurity.github.io/trivy/v0.42/docs/configuration/reporting/#json |
+
diff --git a/docs/configuration/initiatives/rules/git/_category_.json b/docs/configuration/initiatives/rules/git/_category_.json
new file mode 100644
index 000000000..2a7a53690
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Git",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md
new file mode 100644
index 000000000..cd9897d0f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/artifact-signed.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Git Artifact Signed
+title: Git Artifact Signed
+---  
+# Git Artifact Signed  
+**Type:** Rule  
+**ID:** `git-artifact-signed`  
+**Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml)  
+**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego)  
+**Labels:** SBOM, Git  
+
+Verify the Git artifact is signed.
+
+:::note 
+This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS** required by default.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: git/artifact-signed@v2
+with:
+  identity:
+    emails:
+      - bob@company.com
+      - alice@company.com
+```
+
+## Mitigation  
+Ensure that only Git artifacts with valid cryptographic signatures are deployed to prevent source code tampering.
+
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | True |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| identity | `{'common-names': [], 'emails': []}` |
+
diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md
new file mode 100644
index 000000000..ea0e8453f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/coding-permissions.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Restrict Coding Permissions
+title: Restrict Coding Permissions
+---  
+# Restrict Coding Permissions  
+**Type:** Rule  
+**ID:** `git-coding-permissions`  
+**Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml)  
+**Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego)  
+**Labels:** SBOM, Git  
+
+Verify only allowed users committed to the repository.
+
+:::note 
+This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: git/coding-permissions@v2
+```
+
+## Mitigation  
+Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only.
+
+
+## Description  
+This rule verifies that only allowed users have committed to the repository.
+It performs the following steps:
+
+1. Iterates over the commits in the repository.
+2. Checks each commit's author against the list of allowed user IDs.
+   - If a commit's author is not in the allowed list, the rule flags it as a violation.
+3. Checks each committed file against the list of allowed files.
+   - If a committed file is not in the allowed list, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| ids | array | False | The list of user (commit.author) IDs allowed to commit to the repository. |
+| files | array | False | The list of files that are allowed to be committed to the repository. |
+
diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md
new file mode 100644
index 000000000..973c567aa
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/evidence-exists.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: Required Git Evidence Exists
+title: Required Git Evidence Exists
+---  
+# Required Git Evidence Exists  
+**Type:** Rule  
+**ID:** `required-git-evidence`  
+**Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml)  
+**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego)  
+**Labels:** SBOM, Git  
+
+Verify required Git evidence exists.
+
+:::note 
+This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: git/evidence-exists@v2
+```
+
+## Mitigation  
+By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence.
+
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md
new file mode 100644
index 000000000..307164d6a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md
@@ -0,0 +1,55 @@
+---
+sidebar_label: Disallow Commits to Main Branch
+title: Disallow Commits to Main Branch
+---  
+# Disallow Commits to Main Branch  
+**Type:** Rule  
+**ID:** `git-disallow-commits-to-main`  
+**Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml)  
+**Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego)  
+**Labels:** SBOM, Git  
+
+Verify commits made directly to the main branch are disallowed.
+
+:::note 
+This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: git/no-commit-to-main@v2
+```
+
+## Mitigation  
+Enforcing no commits to the main branch ensures that changes are made through pull requests, allowing for code review and approval before merging.
+
+
+## Description  
+This rule ensures that no commits are made directly to the main or master branches.
+It performs the following steps:
+
+1. Check SBOM target branch
+2. If the target branch is the main or master branch, the rule looks for commit objects.
+3. If commit objects are found, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md
new file mode 100644
index 000000000..6144d5a67
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md
@@ -0,0 +1,56 @@
+---
+sidebar_label: Disallow Unsigned Commits
+title: Disallow Unsigned Commits
+---  
+# Disallow Unsigned Commits  
+**Type:** Rule  
+**ID:** `git-disallow-unsigned-commits`  
+**Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.yaml)  
+**Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.rego)  
+**Labels:** Git  
+
+Verify all commits are signed.
+
+:::note 
+This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: git/no-unsigned-commits@v2
+```
+
+## Mitigation  
+Enforcing signed commits ensures reduced risk of unauthorized changes to the repository.
+
+
+## Description  
+This rule ensures that all commits are signed.
+It performs the following steps:
+
+1. Iterates over the commits in the repository.
+2. For each Commit Rule inspects the 'PGPSignature' property of the commit, if it is not present, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- The Source SBOM evidence must be provided in the `cyclonedx-json` format.
+- The Source SBOM should include a `metadata.component.properties` array containing properties that identify base images.
+- The Source SBOM (Software Bill of Materials) must include the `PGPSignature` property for each commit Component.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
diff --git a/docs/configuration/initiatives/rules/github/_category_.json b/docs/configuration/initiatives/rules/github/_category_.json
new file mode 100644
index 000000000..174a64f21
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "GitHub",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/github/api/_category_.json b/docs/configuration/initiatives/rules/github/api/_category_.json
new file mode 100644
index 000000000..e753985fa
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/api/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "GitHub API",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md
new file mode 100644
index 000000000..12552ec0a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md
@@ -0,0 +1,89 @@
+---
+sidebar_label: Branch protection enabled in GitHub repository
+title: Branch protection enabled in GitHub repository
+---  
+# Branch protection enabled in GitHub repository  
+**Type:** Rule  
+**ID:** `github-api-branch-protection`  
+**Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.yaml)  
+**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.rego)  
+**Labels:** GitHub  
+
+Verify GitHub branch protection rules
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/api/branch-protection@v2
+with:
+  owner: "my-org"
+  repo: "my-repo"
+  branch: "main"
+  branch_protection_rules:
+    required_pull_request_reviews.dismiss_stale_reviews: true
+    required_pull_request_reviews.require_code_owner_reviews: true
+    required_pull_request_reviews.require_last_push_approval: true
+    required_pull_request_reviews.required_approving_review_count: 2
+    required_pull_request_reviews.bypass_pull_request_allowances.users: ["user1", "user2"]
+    required_pull_request_reviews.bypass_pull_request_allowances.teams: ["team1"]
+    required_pull_request_reviews.bypass_pull_request_allowances.apps: ["app1"]
+    required_pull_request_reviews.dismissal_restrictions.users: ["user3"]
+    required_pull_request_reviews.dismissal_restrictions.teams: ["team2"]
+    required_pull_request_reviews.dismissal_restrictions.apps: ["app2"]
+    required_status_checks.checks: ["check1", "check2"]
+    required_status_checks.strict: true
+    required_status_checks.contexts: ["context1", "context2"]
+    restrictions.users: ["user4"]
+    restrictions.teams: ["team3"]
+    restrictions.apps: ["app3"]
+    required_signatures: true
+    enforce_admins: true
+    required_linear_history: true
+    allow_force_pushes: false
+    allow_deletions: false
+    block_creations: true
+    required_conversation_resolution: true
+    lock_branch: true
+    allow_fork_syncing: true
+```
+
+## Description  
+# This ones needs a large details
+This rule ensures that the branch protection rules are configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for branch protection configuration.
+2. Verifies that the configuration matches the expected settings.
+2.1. Verifies that the required pull request reviews are configured.
+2.2. Verifies that the required status checks are configured.
+2.3. Verifies that the restrictions are configured.
+2.4. Verifies that the required signatures are configured.
+2.5. Verifies that the enforcement of admins is configured.
+2.6. Verifies that the required linear history is configured.
+2.7. Verifies that the allow force pushes is configured.
+2.8. Verifies that the allow deletions is configured.
+2.9. Verifies that the block creations is configured.
+2.10. Verifies that the required conversation resolution is configured.
+2.11. Verifies that the lock branch is configured.
+2.12. Verifies that the allow fork syncing is configured.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+- Github API token must be provided to access the GitHub API.
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| api_token | `{{ .Args.Token }}` |
+| owner | `{{ .Args.Owner }}` |
+| repo | `{{ .Args.Repo }}` |
+| branch | `{{ .Args.Branch }}` |
+| branch_protection_rules | `{'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False}` |
+
diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md
new file mode 100644
index 000000000..ebf40eb64
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Selected Commits Are Signed API
+title: Verify Selected Commits Are Signed API
+---  
+# Verify Selected Commits Are Signed API  
+**Type:** Rule  
+**ID:** `github-api-signed-commits-list`  
+**Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.yaml)  
+**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.rego)  
+**Labels:** GitHub, API  
+
+Verify selected commits are signed in the GitHub organization.
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/api/signed-commits-list@v2
+with:
+  commit_id_list:
+    - "11111115644ea629569e6a3c98c8375111111"
+    - "22222225644ea629569e6a3c98c8375222222"
+  access_token: '{{ .Args.Token }}'
+  owner: my_owner
+```
+
+## Description  
+This rule ensures that the selected commits are signed in the GitHub organization.
+It performs the following steps:
+
+1. Checks the selected commits in the Selected GitHub repository.
+2. Verifies that the selected commits are signed.
+2.1 Verifies that the selected commits are signed by the proper owner.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources.
+- Github API token must be provided to access the GitHub API.
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| commit_id_list | array | True | List of commit IDs to verify if they are signed. |
+| access_token | string | True | GitHub API access token. |
+| owner | string | True | GitHub repository owner. |
+| repo | string | True | GitHub repository name. |
+
diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md
new file mode 100644
index 000000000..9d0b7093a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Disallow Unsigned Commits In Time Range
+title: Disallow Unsigned Commits In Time Range
+---  
+# Disallow Unsigned Commits In Time Range  
+**Type:** Rule  
+**ID:** `signed-commits-range`  
+**Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.yaml)  
+**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.rego)  
+**Labels:** GitHub  
+
+Verify commits in the specified time range are signed.
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/api/signed-commits-range@v2
+with:
+  access_token: '{{
+    .Args.Token
+  }}'
+  owner: my_owner
+  repo: my_repo
+  since: "2021-01-01T00:00:00Z"
+  until: "2021-01-31T23:59:59Z"
+  sha: "11111115644ea629569e6a3c98c8375111111"
+```
+
+## Description  
+This rule ensures that the commits in the specified time range are signed in the GitHub repository.
+It performs the following steps:
+
+1. Checks the commits in the specified time range in the GitHub repository.
+2. Verifies that the commits in the specified time range are signed.
+2.1 Verifies that the commits in the specified time range are signed by the proper owner.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources.
+- Github API token must be provided to access the GitHub API.
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| access_token | string | True | GitHub API access token. |
+| owner | string | True | GitHub repository owner. |
+| repo | string | True | GitHub repository name. |
+| since | string | False | ISO 8601 date-time string. The beginning of the time range. |
+| until | string | False | ISO 8601 date-time string. The end of the time range. |
+| sha | string | False | The SHA of the commit to verify. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md
new file mode 100644
index 000000000..d46688c3f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/2fa.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify two_factor_requirement_enabled setting
+title: Verify two_factor_requirement_enabled setting
+---  
+# Verify two_factor_requirement_enabled setting  
+**Type:** Rule  
+**ID:** `github-org-2fa`  
+**Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.yaml)  
+**Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `two_factor_requirement` is enabled in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/2fa@v2
+```
+
+## Mitigation  
+Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access  through compromised credentials.
+
+
+## Description  
+This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.
+It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the 
+`organization_details.two_factor_requirement_enabled` field against the expected value.
+
+The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match 
+the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional 
+layer of security against unauthorized access.
+
+### **Evidence Requirements**
+- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.
+- The data should come from a trusted source (e.g., a GitHub organization scan).
+- The evidence must clearly indicate whether 2FA is enabled.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/github/org/_category_.json b/docs/configuration/initiatives/rules/github/org/_category_.json
new file mode 100644
index 000000000..1ce17e465
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Org",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md
new file mode 100644
index 000000000..719d42d2d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify `advanced_security_enabled_for_new_repositories` setting
+title: Verify `advanced_security_enabled_for_new_repositories` setting
+---  
+# Verify `advanced_security_enabled_for_new_repositories` setting  
+**Type:** Rule  
+**ID:** `github-org-advanced-security`  
+**Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.yaml)  
+**Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `advanced_security` is enabled for new repositories in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/advanced-security@v2
+with:
+  desired_value: true
+```
+
+## Mitigation  
+Enforces advanced security for new repositories in the organization, significantly reducing the risk of introducing vulnerabilities or unapproved software.
+
+
+## Description  
+This rule verifies that advanced security is enabled for new repositories in the GitHub organization by examining the provided Discovery evidence.
+It checks the organization's details and compares the value of the 
+`organization_details.advanced_security_enabled_for_new_repositories` field against the expected value.
+
+The rule iterates over the organization data in the evidence, and if the `advanced_security_enabled_for_new_repositories` field does not match 
+the desired value, a violation is recorded. This ensures that all new repositories enforce advanced security, significantly reducing the risk of 
+introducing vulnerabilities or unapproved software.
+
+### **Evidence Requirements**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Desired value for the `advanced_security_enabled_for_new_repositories` setting. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md
new file mode 100644
index 000000000..e241d4aca
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Allowed GitHub Organization Admins
+title: Allowed GitHub Organization Admins
+---  
+# Allowed GitHub Organization Admins  
+**Type:** Rule  
+**ID:** `github-orgallowed-admins`  
+**Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.yaml)  
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.rego)  
+**Labels:** GitHub, Organization  
+
+Verify only users in the Allowed List have admin privileges in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/allow-admins@v2
+with:
+  allowed_admins:
+    - user1
+    - user2
+    - user3
+```
+
+## Mitigation  
+Ensures that only approved users have admin privileges in the GitHub organization, reducing the risk of unauthorized access  through compromised credentials.
+
+
+## Description  
+This rule verifies that only users in the Allowed List have admin privileges in the GitHub organization.
+It checks the organization's details and compares the value of the 
+`organization_details.admins` field against the expected value.
+
+The rule iterates over the organization data in the evidence, and if the `admins` field does not match 
+the desired value, a violation is recorded. This ensures that only users in the Allowed List have admin privileges in the GitHub organization.
+
+### **Evidence Requirements**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of allowed GitHub organization admins. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md
new file mode 100644
index 000000000..2a3c43722
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/allow-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed GitHub Organization Users
+title: Allowed GitHub Organization Users
+---  
+# Allowed GitHub Organization Users  
+**Type:** Rule  
+**ID:** `github-org-allowed-users`  
+**Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.yaml)  
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.rego)  
+**Labels:** GitHub, Organization  
+
+Verify only users in the Allowed List have user access to the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/allow-users@v2
+with:
+  allowed_users:
+    - "user1"
+    - "user2"
+```
+
+## Mitigation  
+Ensures that only approved users have access to the GitHub organization, reducing the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that only users specified in the allowed list have access to the GitHub organization.
+It performs the following steps:
+
+1. Iterates over the users in the GitHub organization.
+2. Checks each user against the allowed list specified in the `with.allowed_users` configuration.
+   - If a user is not in the allowed list, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of allowed users. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md
new file mode 100644
index 000000000..7a15a2a19
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Verify members_can_create_private_repositories setting
+title: Verify members_can_create_private_repositories setting
+---  
+# Verify members_can_create_private_repositories setting  
+**Type:** Rule  
+**ID:** `github-org-create-private-repos`  
+**Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml)  
+**Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise).
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/create-private-repos@v2
+with:
+  allowed_users:
+    - "user1"
+    - "user2"
+```
+
+## Mitigation  
+Ensures that only approved users can create private repositories in the GitHub organization, reducing the risk of unauthorized repository creation.
+
+
+## Description  
+This rule ensures that only users specified in the allowed list can create private repositories in the GitHub organization.
+It performs the following steps:
+
+1. Iterates over the users in the GitHub organization.
+2. Checks each user's permissions to create private repositories against the allowed list specified in the `with.allowed_users` configuration.
+   - If a user not in the allowed list has permissions to create private repositories, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of allowed users. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md
new file mode 100644
index 000000000..83a91cff8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/create-repos.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify members_can_create_repositories setting
+title: Verify members_can_create_repositories setting
+---  
+# Verify members_can_create_repositories setting  
+**Type:** Rule  
+**ID:** `github-org-create-repos`  
+**Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml)  
+**Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `members_can_create_repositories` is appropriately configured in the GitHub repository.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/create-repos@v2
+with:
+  desired_value: false
+```
+
+## Mitigation  
+Ensures that only approved users can create repositories in the GitHub organization, reducing the risk of unauthorized repository creation.
+
+
+## Description  
+This rule ensures that only users specified in the allowed list can create repositories in the GitHub organization.
+It performs the following steps:
+
+1. Iterates over the users in the GitHub organization.
+2. Checks each user's permissions to create repositories against the allowed list specified in the `with.allowed_users` configuration.
+   - If a user not in the allowed list has permissions to create repositories, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | The desired value for the `members_can_create_repositories` setting. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md
new file mode 100644
index 000000000..fc00cb9fc
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify dependabot_alerts_enabled_for_new_repositories setting
+title: Verify dependabot_alerts_enabled_for_new_repositories setting
+---  
+# Verify dependabot_alerts_enabled_for_new_repositories setting  
+**Type:** Rule  
+**ID:** `github-org-dependabot-alerts`  
+**Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.yaml)  
+**Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.rego)  
+**Labels:** GitHub, Organization  
+
+Verify Dependabot alerts for new repositories are enabled in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/dependabot-alerts@v2
+with:
+  desired_value: true
+```
+
+## Mitigation  
+Ensures that Dependabot alerts are enabled for new repositories in the GitHub organization, helping to identify and address vulnerabilities in dependencies.
+
+
+## Description  
+This rule verifies that Dependabot alerts for new repositories are enabled in the GitHub organization.
+It performs the following steps:
+
+1. Checks the organization's settings for the `dependabot_alerts_enabled_for_new_repositories` field.
+2. Compares the value of this field against the desired value specified in the `with.desired_value` configuration.
+   - If the field does not match the desired value, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Desired value for the dependabot_alerts_enabled_for_new_repositories setting. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md
new file mode 100644
index 000000000..75ab66e23
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify dependabot_security_updates setting in security_and_analysis
+title: Verify dependabot_security_updates setting in security_and_analysis
+---  
+# Verify dependabot_security_updates setting in security_and_analysis  
+**Type:** Rule  
+**ID:** `github-org-dependabot-security-updates-sa`  
+**Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml)  
+**Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.rego)  
+**Labels:** GitHub, Organization  
+
+Verify Dependabot security updates are configured in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/dependabot-security-updates-sa@v2
+```
+
+## Mitigation  
+Ensures that Dependabot security updates are enabled in the GitHub organization, reducing the risk of vulnerabilities in dependencies.
+
+
+## Description  
+This rule ensures that Dependabot security updates are enabled in the GitHub organization.
+It performs the following steps:
+
+1. Checks the security and analysis settings of the GitHub organization.
+2. Verifies that the Dependabot security updates setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md
new file mode 100644
index 000000000..8aaf34c7d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify dependabot_security_updates_enabled_for_new_repositories setting
+title: Verify dependabot_security_updates_enabled_for_new_repositories setting
+---  
+# Verify dependabot_security_updates_enabled_for_new_repositories setting  
+**Type:** Rule  
+**ID:** `github-org-dependabot-security-updates`  
+**Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml)  
+**Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.rego)  
+**Labels:** GitHub, Organization  
+
+Verify Dependabot security updates for new repositories are configured in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/dependabot-security-updates@v2
+with:
+  desired_value: true
+```
+
+## Mitigation  
+Ensures that Dependabot security updates are enabled for new repositories in the GitHub organization, reducing the risk of vulnerabilities in dependencies.
+
+
+## Description  
+This rule ensures that Dependabot security updates are enabled for new repositories in the GitHub organization.
+It performs the following steps:
+
+1. Checks the security and analysis settings of the GitHub organization.
+2. Verifies that the Dependabot security updates setting is enabled for new repositories.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Indicates if Dependabot security updates for new repositories are enabled. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md
new file mode 100644
index 000000000..1d5f53b2e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify dependency_graph_enabled_for_new_repositories setting
+title: Verify dependency_graph_enabled_for_new_repositories setting
+---  
+# Verify dependency_graph_enabled_for_new_repositories setting  
+**Type:** Rule  
+**ID:** `github-org-dependency-graph`  
+**Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml)  
+**Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `dependency_graph` is enabled for new repositories in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/dependency-graph@v2
+with:
+  desired_value: true
+```
+
+## Mitigation  
+Ensures that the dependency graph is enabled in the GitHub organization, providing better visibility into dependencies and potential vulnerabilities.
+
+
+## Description  
+This rule ensures that the dependency graph is enabled in the GitHub organization.
+It performs the following steps:
+
+1. Checks the settings of the GitHub organization.
+2. Verifies that the dependency graph setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Indicates if the dependency graph is enabled. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md
new file mode 100644
index 000000000..514ae87a8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/max-admins.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Limit Admin Number in GitHub Organization
+title: Limit Admin Number in GitHub Organization
+---  
+# Limit Admin Number in GitHub Organization  
+**Type:** Rule  
+**ID:** `github-org-max-admins`  
+**Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml)  
+**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego)  
+**Labels:** GitHub, Organization  
+
+Verify the maximum number of GitHub organization admins is restricted.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/max-admins@v2
+with:
+  max_admins: 5
+```
+
+## Mitigation  
+Ensures that the number of admins in the GitHub organization is kept within a manageable limit, reducing the risk of unauthorized administrative actions.
+
+
+## Description  
+This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.
+It performs the following steps:
+
+1. Checks the list of admins in the GitHub organization.
+2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_admins | integer | False | Maximum number of admins allowed. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md
new file mode 100644
index 000000000..b471114c6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify GitHub Organization Secrets Are Not Too Old
+title: Verify GitHub Organization Secrets Are Not Too Old
+---  
+# Verify GitHub Organization Secrets Are Not Too Old  
+**Type:** Rule  
+**ID:** `github-org-old-secrets`  
+**Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.yaml)  
+**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.rego)  
+**Labels:** GitHub, Organization  
+
+Verify secrets in the GitHub organization are not older than the specified threshold.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/old-secrets@v2
+with:
+  max_secret_age: 12
+```
+
+## Mitigation  
+Ensures that old secrets are removed from the GitHub organization, reducing the risk of exposure of outdated and potentially compromised secrets.
+
+
+## Description  
+This rule ensures that secrets in the GitHub organization are not older than the specified threshold.
+It performs the following steps:
+
+1. Checks the list of secrets in the GitHub organization.
+2. Verifies that no secrets are older than the value specified in the `with.max_secret_age` configuration.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_secret_age | integer | False | Maximum age of secrets in months. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md
new file mode 100644
index 000000000..89ff86260
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify `secret_scanning_push_protection_custom_link_enabled` Setting
+title: Verify `secret_scanning_push_protection_custom_link_enabled` Setting
+---  
+# Verify `secret_scanning_push_protection_custom_link_enabled` Setting  
+**Type:** Rule  
+**ID:** `github-org-pp-custom-link`  
+**Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml)  
+**Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/pp-custom-link@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md
new file mode 100644
index 000000000..e9385c45d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify `secret_scanning_push_protection` Setting
+title: Verify `secret_scanning_push_protection` Setting
+---  
+# Verify `secret_scanning_push_protection` Setting  
+**Type:** Rule  
+**ID:** `github-org-push-protection-sa`  
+**Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml)  
+**Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `secret_scanning_push_protection` is configured in the GitHub repository.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/push-protection-sa@v2
+```
+
+## Mitigation  
+Ensure that secret scanning push protection is enabled to provide better security for secret scanning in the GitHub organization.
+
+
+## Description  
+This rule ensures that secret scanning push protection is enabled in the security and analysis settings of the GitHub organization.
+It performs the following steps:
+
+1. Checks the security and analysis settings of the GitHub organization.
+2. Verifies that the secret scanning push protection setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md
new file mode 100644
index 000000000..cc451052e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/push-protection.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify `secret_scanning_push_protection_enabled_for_new_repositories`
+  Setting
+title: Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting
+---  
+# Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting  
+**Type:** Rule  
+**ID:** `github-org-push-protection`  
+**Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml)  
+**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/push-protection@v2
+with:
+  desired_value: true
+```
+
+## Mitigation  
+Ensures that secret scanning push protection is enabled for new repositories in the GitHub organization, providing better security for secret scanning.
+
+
+## Description  
+This rule ensures that secret scanning push protection is enabled for new repositories in the GitHub organization.
+It performs the following steps:
+
+1. Checks the security and analysis settings of the GitHub organization.
+2. Verifies that the secret scanning push protection setting is enabled for new repositories.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Indicates if the secret scanning push protection is enabled for new repositories. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md
new file mode 100644
index 000000000..2cefacaff
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify Repo Visibility Setting
+title: Verify Repo Visibility Setting
+---  
+# Verify Repo Visibility Setting  
+**Type:** Rule  
+**ID:** `github-org-repo-visibility`  
+**Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml)  
+**Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego)  
+**Labels:** GitHub, Organization  
+
+Verify only repositories in the Allowed List are public in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/repo-visibility@v2
+with:
+  allowed_repo_names:
+    - "my_org/.*"
+    - "my_org/my_repo/.*"
+```
+
+## Mitigation  
+Ensure that the repository visibility setting is configured correctly to reduce the risk of unauthorized access to repositories.
+
+
+## Description  
+This rule ensures that the repository visibility setting is configured correctly in the GitHub organization.
+It performs the following steps:
+
+1. Checks the visibility settings of repositories in the GitHub organization.
+2. Verifies that the visibility setting matches the value specified in the `with.desired_visibility` configuration.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_repo_names | array | False | List of repository pattern allowed to be visible. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md
new file mode 100644
index 000000000..e56515aff
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify `secret_scanning` Setting in `security_and_analysis`
+title: Verify `secret_scanning` Setting in `security_and_analysis`
+---  
+# Verify `secret_scanning` Setting in `security_and_analysis`  
+**Type:** Rule  
+**ID:** `github-org-secret-scanning-sa`  
+**Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.yaml)  
+**Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `secret_scanning` is configured in the GitHub repository.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/secret-scanning-sa@v2
+```
+
+## Mitigation  
+Ensure that the Secret Scanning setting is enabled to detect and prevent the exposure of secrets in the organization’s repositories, enhancing security.
+
+
+## Description  
+This rule checks if the `secret_scanning` setting is enabled to detect and prevent the exposure of secrets in the organization’s repositories.
+It performs the following steps:
+
+1. Checks the secret scanning settings of the GitHub organization.
+2. Verifies that the secret scanning setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md
new file mode 100644
index 000000000..b24e4f913
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify secret_scanning_enabled_for_new_repositories setting
+title: Verify secret_scanning_enabled_for_new_repositories setting
+---  
+# Verify secret_scanning_enabled_for_new_repositories setting  
+**Type:** Rule  
+**ID:** `github-org-secret-scanning`  
+**Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.yaml)  
+**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `secret_scanning` is enabled for new repositories in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/secret-scanning@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md
new file mode 100644
index 000000000..f94d06d01
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`
+title: Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`
+---  
+# Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`  
+**Type:** Rule  
+**ID:** `github-org-validity-checks-sa`  
+**Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml)  
+**Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `secret_scanning_validity_checks` is configured in the GitHub organization.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/validity-checks-sa@v2
+```
+
+## Mitigation  
+Ensure that the Validity checks under GitHub organization setting is enabled to maintain the integrity of the organization’s repositories, preventing potential issues and vulnerabilities.
+
+
+## Description  
+This rule checks if the `validity_checks` under GitHub organization setting is enabled to ensure the integrity of the organization’s repositories.
+It performs the following steps:
+
+1. Checks the validity checks settings of the GitHub organization.
+2. Verifies that the validity checks setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md
new file mode 100644
index 000000000..8fd03dbee
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify `secret_scanning_validity_checks_enabled` Setting
+title: Verify `secret_scanning_validity_checks_enabled` Setting
+---  
+# Verify `secret_scanning_validity_checks_enabled` Setting  
+**Type:** Rule  
+**ID:** `github-org-validity-checks`  
+**Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.yaml)  
+**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego)  
+**Labels:** GitHub, Organization  
+
+Verify `secret_scanning_validity_checks` is configured in the GitHub repository.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/validity-checks@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md
new file mode 100644
index 000000000..f9873966a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify GitHub Organization Requires Signoff on Web Commits
+title: Verify GitHub Organization Requires Signoff on Web Commits
+---  
+# Verify GitHub Organization Requires Signoff on Web Commits  
+**Type:** Rule  
+**ID:** `github-org-web-commit-signoff`  
+**Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.yaml)  
+**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego)  
+**Labels:** GitHub, Organization  
+
+Verify contributors sign commits through the GitHub web interface.
+
+:::note 
+This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/org/web-commit-signoff@v2
+```
+
+## Mitigation  
+Ensure that the Web Commit Signoff setting under the GitHub organization is enabled to require signoff on all web-based commits, enhancing security and accountability.
+
+
+## Description  
+This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.
+It performs the following steps:
+
+1. Checks the web commit signoff settings of the GitHub organization.
+2. Verifies that the web commit signoff setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/_category_.json b/docs/configuration/initiatives/rules/github/repository/_category_.json
new file mode 100644
index 000000000..e93f68442
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Repository",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md
new file mode 100644
index 000000000..7cc969dd8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Verify Branch Protection Setting
+title: Verify Branch Protection Setting
+---  
+# Verify Branch Protection Setting  
+**Type:** Rule  
+**ID:** `github-repo-branch-protection`  
+**Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.yaml)  
+**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.rego)  
+**Labels:** GitHub, Repository  
+
+Verify branch protection is configured in the GitHub repository.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/branch-protection@v2
+with:
+  desired_protected: true
+  branches:
+    - 'main'
+    - 'master'
+```
+
+## Mitigation  
+Ensure branch protection settings are correctly configured to reduce the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that branch protection is configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for branch protection.
+2. Verifies that the protection settings match the expected values.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_protected | boolean | False | Desired branch protection setting. |
+| branches | array | False | List of branches to be protected. |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md
new file mode 100644
index 000000000..41ba68ac2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Verify Branch Verification Setting
+title: Verify Branch Verification Setting
+---  
+# Verify Branch Verification Setting  
+**Type:** Rule  
+**ID:** `github-repo-branch-verification`  
+**Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.yaml)  
+**Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.rego)  
+**Labels:** GitHub, Repository  
+
+Verify branch verification in the GitHub repository matches the value defined in the configuration file.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/branch-verification@v2
+```
+
+## Mitigation  
+Ensures that branch verification settings are correctly configured, reducing the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that branch verification in the GitHub repository matches the value defined in the configuration file.
+It performs the following steps:
+
+1. Checks the repository settings for branch verification.
+2. Verifies that the verification setting matches the expected value.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_verified | True |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md
new file mode 100644
index 000000000..49092cd5e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify All Commits Are Signed in Repository
+title: Verify All Commits Are Signed in Repository
+---  
+# Verify All Commits Are Signed in Repository  
+**Type:** Rule  
+**ID:** `github-repo-signed-commits`  
+**Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.yaml)  
+**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.rego)  
+**Labels:** GitHub, Repository  
+
+Verify all commits in the GitHub repository are signed.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/check-signed-commits@v2
+```
+
+## Mitigation  
+Ensures that all commits are signed, reducing the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that all commits in the GitHub repository are signed.
+It performs the following steps:
+
+1. Iterates over the commits in the repository.
+2. Checks each commit for a valid signature.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository commits.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md
new file mode 100644
index 000000000..7b218d538
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Default Branch Protection
+title: Verify Default Branch Protection
+---  
+# Verify Default Branch Protection  
+**Type:** Rule  
+**ID:** `github-repo-default-branch-protection`  
+**Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.yaml)  
+**Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.rego)  
+**Labels:** GitHub, Repository  
+
+Verify the default branch protection is configured in the GitHub repository.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/default-branch-protection@v2
+```
+
+## Mitigation  
+Ensures that the default branch is protected, reducing the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that the default branch protection is configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for default branch protection configuration.
+2. Verifies that the configuration matches the expected settings.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md
new file mode 100644
index 000000000..5f3864c1d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Dependabot security updates setting
+title: Verify Dependabot security updates setting
+---  
+# Verify Dependabot security updates setting  
+**Type:** Rule  
+**ID:** `github-repo-dependabot`  
+**Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml)  
+**Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.rego)  
+**Labels:** GitHub, Repository  
+
+Verify Dependabot security updates are configured in the GitHub repository.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/dependabot@v2
+```
+
+## Mitigation  
+Ensures that Dependabot security updates are enabled, reducing the risk of vulnerabilities in dependencies.
+
+
+## Description  
+This rule ensures that Dependabot security updates are configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for Dependabot security updates configuration.
+2. Verifies that the configuration matches the expected settings.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md
new file mode 100644
index 000000000..960486aa3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Only Ephemeral Runners Exist in Repository
+title: Verify Only Ephemeral Runners Exist in Repository
+---  
+# Verify Only Ephemeral Runners Exist in Repository  
+**Type:** Rule  
+**ID:** `github-repo-ephemeral-runners-only`  
+**Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.yaml)  
+**Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.rego)  
+**Labels:** GitHub, Repository  
+
+Verify self-hosted runners are disallowed in the GitHub repository.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/ephemeral-runners-only@v2
+```
+
+## Mitigation  
+Ensures that only ephemeral runners are used, reducing the risk of persistent runner vulnerabilities.
+
+
+## Description  
+This rule ensures that only ephemeral runners are used in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for runner configuration.
+2. Verifies that only ephemeral runners are used.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md
new file mode 100644
index 000000000..5733c665c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify No Cache Usage Exists in Repository
+title: Verify No Cache Usage Exists in Repository
+---  
+# Verify No Cache Usage Exists in Repository  
+**Type:** Rule  
+**ID:** `github-repo-no-cache-usage`  
+**Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.yaml)  
+**Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.rego)  
+**Labels:** GitHub, Repository  
+
+Verify the GitHub repository has no cache usage.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/no-cache-usage@v2
+```
+
+## Mitigation  
+Ensures that no cache is used, reducing the risk of outdated or insecure dependencies.
+
+
+## Description  
+This rule ensures that no cache is used in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for cache usage.
+2. Verifies that no cache is used.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md
new file mode 100644
index 000000000..d202d64f5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify No Organization Secrets Exist in Repository
+title: Verify No Organization Secrets Exist in Repository
+---  
+# Verify No Organization Secrets Exist in Repository  
+**Type:** Rule  
+**ID:** `github-repo-no-org-secrets`  
+**Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.yaml)  
+**Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.rego)  
+**Labels:** GitHub, Repository  
+
+Verify no organization secrets exist in the GitHub repository.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/no-org-secrets@v2
+```
+
+## Mitigation  
+Ensures that no organization secrets are used, reducing the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that no organization secrets are used in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for organization secrets.
+2. Verifies that no organization secrets are used.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md
new file mode 100644
index 000000000..11a2818cb
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Verify No Old Secrets Exist in Repository
+title: Verify No Old Secrets Exist in Repository
+---  
+# Verify No Old Secrets Exist in Repository  
+**Type:** Rule  
+**ID:** `github-repo-old-secrets`  
+**Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.yaml)  
+**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.rego)  
+**Labels:** GitHub, Repository  
+
+Verify secrets in the GitHub repository are not older than the specified threshold.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/old-secrets@v2
+```
+
+## Mitigation  
+Ensures that secrets are rotated regularly, reducing the risk of compromised secrets.
+
+
+## Description  
+This rule ensures that secrets in the GitHub repository are not older than the specified threshold.
+It performs the following steps:
+
+1. Checks the repository settings for secrets.
+2. Verifies that the age of each secret does not exceed the specified threshold.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| max_secret_age | 12 |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md
new file mode 100644
index 000000000..37aba58b5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Push Protection Setting
+title: Verify Push Protection Setting
+---  
+# Verify Push Protection Setting  
+**Type:** Rule  
+**ID:** `github-repo-push-protection`  
+**Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.yaml)  
+**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego)  
+**Labels:** GitHub, Repository  
+
+Verify `secret_scanning_push_protection` is configured in the GitHub repository.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/push-protection@v2
+```
+
+## Mitigation  
+Ensures that push protection is enabled, reducing the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that push protection is enabled in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for push protection.
+2. Verifies that push protection is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md
new file mode 100644
index 000000000..f8d41c763
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Repository Is Private
+title: Verify Repository Is Private
+---  
+# Verify Repository Is Private  
+**Type:** Rule  
+**ID:** `github-repo-private`  
+**Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.yaml)  
+**Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.rego)  
+**Labels:** GitHub, Repository  
+
+Verify the GitHub repository is private.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/repo-private@v2
+```
+
+## Mitigation  
+Ensures that the repository is private, reducing the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that the GitHub repository is private.
+It performs the following steps:
+
+1. Checks the repository settings for privacy.
+2. Verifies that the repository is private.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md
new file mode 100644
index 000000000..18a31d703
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify secret_scanning setting
+title: Verify secret_scanning setting
+---  
+# Verify secret_scanning setting  
+**Type:** Rule  
+**ID:** `github-repo-secret-scanning`  
+**Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.yaml)  
+**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego)  
+**Labels:** GitHub, Repository  
+
+Verify `secret_scanning` is configured in the GitHub repository.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/secret-scanning@v2
+```
+
+## Mitigation  
+Ensures that Secret Scanning is configured, reducing the risk of leaking sensitive information.
+
+
+## Description  
+This rule ensures that the `secret_scanning` is configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for `secret_scanning` configuration.
+2. Verifies that the configuration matches the expected settings.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md
new file mode 100644
index 000000000..d5840ee01
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify All Commits Are Signed in Repository
+title: Verify All Commits Are Signed in Repository
+---  
+# Verify All Commits Are Signed in Repository  
+**Type:** Rule  
+**ID:** `github-repo-signed-commits`  
+**Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.yaml)  
+**Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.rego)  
+**Labels:** GitHub, Repository  
+
+Verify all commits are signed in a repository attestation.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/signed-commits@v2
+```
+
+## Mitigation  
+Ensures that all commits are signed, reducing the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that all commits in the GitHub repository are signed.
+It performs the following steps:
+
+1. Iterates over the commits in the repository.
+2. Checks each commit for a valid signature.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository commits.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md
new file mode 100644
index 000000000..531d1ef96
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify secret scanning.
+title: Verify secret scanning.
+---  
+# Verify secret scanning.  
+**Type:** Rule  
+**ID:** `github-repo-validity-checks`  
+**Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.yaml)  
+**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego)  
+**Labels:** GitHub, Repository  
+
+Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/validity-checks@v2
+```
+
+## Mitigation  
+Ensure that the validity checks are set in the GitHub organization and all the repositories.
+
+
+## Description  
+This rule ensures that both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories.
+It performs the following steps:
+
+1. Checks the organization settings for `secret_scanning_validity_checks` and `security_and_analysis`.
+2. Verifies that the settings are configured as expected.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md
new file mode 100644
index 000000000..0d9ddb3eb
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/visibility.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Public Repositories
+title: Allowed Public Repositories
+---  
+# Allowed Public Repositories  
+**Type:** Rule  
+**ID:** `github-repo-visibility`  
+**Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.yaml)  
+**Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.rego)  
+**Labels:** GitHub, Repository  
+
+Verify only GitHub repositories in the Allowed List are public.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/visibility@v2
+with:
+  allowed_repo_names:
+  - my-org/.*
+  - my-org/my-repo.*
+```
+
+## Mitigation  
+Ensures that only allowed repositories are public, reducing the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that only GitHub repositories in the Allowed List are public.
+It performs the following steps:
+
+1. Checks the repository settings for visibility.
+2. Verifies that the repository is public only if it is in the Allowed List.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_repo_names | string | False | List of allowed repository patterns. |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md
new file mode 100644
index 000000000..77cc2432a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Repository Requires Commit Signoff
+title: Verify Repository Requires Commit Signoff
+---  
+# Verify Repository Requires Commit Signoff  
+**Type:** Rule  
+**ID:** `github-repo-web-commit-signoff`  
+**Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.yaml)  
+**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.rego)  
+**Labels:** GitHub, Repository  
+
+Verify contributors sign off on commits to the GitHub repository through the GitHub web interface.
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/web-commit-signoff@v2
+```
+
+## Mitigation  
+Ensure that the repository requires signoff on all commits made through the GitHub web interface, enhancing security and accountability.
+
+
+## Description  
+This rule checks if the repository requires signoff on all commits made through the GitHub web interface.
+It performs the following steps:
+
+1. Checks the repository settings for commit signoff.
+2. Verifies that the repository requires signoff on all commits made through the GitHub web interface.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/_category_.json b/docs/configuration/initiatives/rules/gitlab/_category_.json
new file mode 100644
index 000000000..d41c80a07
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Gitlab",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/api/_category_.json b/docs/configuration/initiatives/rules/gitlab/api/_category_.json
new file mode 100644
index 000000000..1cd6c97e0
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/api/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Gitlab API",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md
new file mode 100644
index 000000000..ed920bec2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md
@@ -0,0 +1,67 @@
+---
+sidebar_label: Set Push Rules in GitLab
+title: Set Push Rules in GitLab
+---  
+# Set Push Rules in GitLab  
+**Type:** Rule  
+**ID:** `gitlab-api-push-rules`  
+**Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.yaml)  
+**Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.rego)  
+**Labels:** Gitlab, API  
+
+Verify GitLab push rules are configured via the API.
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/api/push-rules@v2
+with:
+  api_token: '{{ .Args.Token }}'
+  project: my_project
+  push_rule:
+    commit_message_regex: .*hotfix:.*
+    commit_message_negative_regex: .*fixme.*
+    branch_name_regex: .*main.*
+    deny_delete_tag: true
+    member_check: true
+    prevent_secrets: true
+    author_email_regex: .*@example.com
+    file_name_regex: "abc"
+    max_file_size: 100
+    commit_committer_name_check: "enabled"
+    reject_unsigned_commits: "enabled"
+```
+
+## Description  
+This rule ensures that GitLab push rules are configured via the API.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the push rules are configured via the API.
+2.1 Verifies that the push rules are configured with the proper settings.
+2.2 Verifies that the push rules are configured with the proper regular expressions.
+2.3 Verifies that the push rules are configured with the proper file size.
+2.4 Verifies that the push rules are configured with the proper member check.
+2.5 Verifies that the push rules are configured with the proper secrets prevention.
+2.6 Verifies that the push rules are configured with the proper tag deletion prevention.
+2.7 Verifies that the push rules are configured with the proper author email regular expression.
+2.8 Verifies that the push rules are configured with the proper file name regular expression.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+- GitLab API token must be provided to access the GitLab API.
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| api_token | string | True | GitLab API access token. |
+| project | string | True | GitLab project name. |
+| push_rule | object | True | GitLab push rules. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md
new file mode 100644
index 000000000..9856be44f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md
@@ -0,0 +1,40 @@
+---
+sidebar_label: Sign Selected Commits in GitLab
+title: Sign Selected Commits in GitLab
+---  
+# Sign Selected Commits in GitLab  
+**Type:** Rule  
+**ID:** `gitlab-api-signed-commits-list`  
+**Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.yaml)  
+**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.rego)  
+**Labels:** Gitlab, API  
+
+Verify the selected commits are signed in the GitLab organization.
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/api/signed-commits-list@v2
+with:
+  commit_id_list:
+    - 'commit1'
+    - 'commit2'
+    - 'commit3'
+  private_token: {{ .Args.Token }}
+  project_id: {{ .Args.ProjectID }}
+```
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| commit_id_list | [] |
+| private_token |  |
+| project_id |  |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md
new file mode 100644
index 000000000..341ba70a7
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md
@@ -0,0 +1,55 @@
+---
+sidebar_label: Sign Selected Commit Range in GitLab
+title: Sign Selected Commit Range in GitLab
+---  
+# Sign Selected Commit Range in GitLab  
+**Type:** Rule  
+**ID:** `gitlab-api-signed-commits-range`  
+**Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml)  
+**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego)  
+**Labels:** Gitlab, API  
+
+Verify the selected range of commits is signed via the GitLab API.
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/api/signed-commits-range@v2
+with:
+  since: "2021-01-01T00:00:00Z"
+  until: "2021-01-31T23:59:59Z"
+  project_id: my_project_id
+  private_token: '{{ .Args.Token }}'
+```
+
+## Mitigation  
+Ensure that the commits in the specified time range are signed in the GitLab repository.
+
+
+## Description  
+This rule ensures that the commits in the specified time range are signed in the GitLab repository.
+It performs the following steps:
+
+1. Checks the commits in the specified time range in the GitLab repository.
+2. Verifies that the commits in the specified time range are signed.
+2.1 Verifies that the commits in the specified time range are signed by the proper owner.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab repository resources.
+- GitLab API token must be provided to access the GitLab API.
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| since | string | False | ISO 8601 date-time string. The beginning of the time range. |
+| until | string | False | ISO 8601 date-time string. The end of the time range. |
+| project_id | string | True | GitLab project ID. |
+| private_token | string | True | GitLab API access token. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/_category_.json b/docs/configuration/initiatives/rules/gitlab/org/_category_.json
new file mode 100644
index 000000000..1ce17e465
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Org",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md
new file mode 100644
index 000000000..745f211b6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Admins in GitLab Organization
+title: Allowed Admins in GitLab Organization
+---  
+# Allowed Admins in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-allowed-admins`  
+**Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.yaml)  
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.rego)  
+**Labels:** Gitlab, Organization  
+
+Verify only users in the Allowed List have admin privileges in the GitLab organization.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/allow-admins@v2
+with:
+  allowed_admins:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have admin privileges in the GitLab organization to reduce the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have admin privileges in the GitLab organization.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md
new file mode 100644
index 000000000..eda5c397a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Restrict Token Scopes in GitLab
+title: Restrict Token Scopes in GitLab
+---  
+# Restrict Token Scopes in GitLab  
+**Type:** Rule  
+**ID:** `gitlab-org-allowed-token-scope`  
+**Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.yaml)  
+**Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.rego)  
+**Labels:** Gitlab, Organization  
+
+Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/allow-token-scopes@v2
+with:
+  allowed_token_scopes:
+    - api
+    - read_api
+    - read_repository
+    - read_registry
+```
+
+## Description  
+This rule ensures that all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that all tokens are restricted to allowed scopes.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_token_scopes | array | False | List of allowed token scopes in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md
new file mode 100644
index 000000000..d507e4271
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Users in GitLab Organization
+title: Allowed Users in GitLab Organization
+---  
+# Allowed Users in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-allowed-users`  
+**Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.yaml)  
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.rego)  
+**Labels:** Gitlab, Organization  
+
+Verify only users in the Allowed List have access to the GitLab organization.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/allow-users@v2
+with:
+  allowed_users:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have access to the GitLab organization to reduce the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have access to the GitLab organization.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that only users in the Allowed List have access.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of users allowed to have access to the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md
new file mode 100644
index 000000000..359ab1c17
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Block Users in GitLab Organization
+title: Block Users in GitLab Organization
+---  
+# Block Users in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-blocked-users`  
+**Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.yaml)  
+**Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.rego)  
+**Labels:** Gitlab, Organization  
+
+Verify no users in the GitLab organization are on the block list.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/blocked-users@v2
+with:
+  blocked_users:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that no users are on the block list in the GitLab organization to reduce the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that no users in the GitLab organization are on the block list.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no users are on the block list.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| blocked_users | array | False | List of users blocked in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md
new file mode 100644
index 000000000..6b2a86754
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Prevent Token Expiration in GitLab Organization
+title: Prevent Token Expiration in GitLab Organization
+---  
+# Prevent Token Expiration in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-token-about-to-expire`  
+**Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.yaml)  
+**Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.rego)  
+**Labels:** Gitlab, Organization  
+
+Verify no GitLab organization tokens are about to expire.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/expiring-tokens@v2
+with:
+  exiring_in_days: 30
+```
+
+## Mitigation  
+Ensure that no GitLab organization tokens are about to expire to prevent service disruption.
+
+
+## Description  
+This rule ensures that no GitLab organization tokens are about to expire.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no tokens are about to expire.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| exiring_in_days | number | False | Number of days before a token expires. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md
new file mode 100644
index 000000000..c46b3e2c8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Forbid Token Scopes in GitLab Organization
+title: Forbid Token Scopes in GitLab Organization
+---  
+# Forbid Token Scopes in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-disallowed-token-scope`  
+**Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.yaml)  
+**Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.rego)  
+**Labels:** Blueprint, Gitlab, Organization  
+
+Verify no GitLab organization tokens have disallowed scopes.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/forbid-token-scopes@v2
+with:
+  project_scopes:
+    - write_api
+    - write_repository
+```
+
+## Mitigation  
+Ensure that no GitLab organization tokens have disallowed scopes to prevent excessive permission.
+
+
+## Description  
+This rule ensures that no GitLab organization tokens have disallowed scopes.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no tokens have disallowed scopes.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| project_scopes | array | False | List of disallowed token scopes in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md
new file mode 100644
index 000000000..099353af5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Ensure Active Projects in GitLab Organization
+title: Ensure Active Projects in GitLab Organization
+---  
+# Ensure Active Projects in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-inactive-projects`  
+**Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.yaml)  
+**Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.rego)  
+**Labels:** Gitlab, Organization  
+
+Verify no GitLab organization projects are inactive.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/inactive-projects@v2
+with:
+  inactive_for_days: 90
+```
+
+## Mitigation  
+Ensure that no GitLab organization projects are inactive to prevent service disruption.
+
+
+## Description  
+This rule ensures that no GitLab organization projects are inactive.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no projects are inactive.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| inactive_for_days | number | False | Number of days before a project is considered inactive. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md
new file mode 100644
index 000000000..198fe2a9d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Forbid Long-Lived Tokens in GitLab Organization
+title: Forbid Long-Lived Tokens in GitLab Organization
+---  
+# Forbid Long-Lived Tokens in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-token-excessive-lifespan`  
+**Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.yaml)  
+**Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.rego)  
+**Labels:** Blueprint, Gitlab, Organization  
+
+Verify no GitLab organization tokens have an excessively long lifespan.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/longlive-tokens@v2
+with:
+  exiring_in_days: 365
+```
+
+## Mitigation  
+Ensure that no GitLab organization tokens have an excessively long lifespan to prevent service disruption.
+
+
+## Description  
+This rule ensures that no GitLab organization tokens have an excessively long lifespan.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no tokens have an excessively long lifespan.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| exiring_in_days | number | False | Number of days before a token expires. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md
new file mode 100644
index 000000000..9ded2a929
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Limit Admins in GitLab Organization
+title: Limit Admins in GitLab Organization
+---  
+# Limit Admins in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-max-admins`  
+**Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.yaml)  
+**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.rego)  
+**Labels:** Blueprint, GitLab, Organization  
+
+Verify the maximum number of admins for the GitLab project is restricted.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/max-admins@v2
+with:
+  max_admins: 0
+```
+
+## Mitigation  
+Ensure that the maximum number of admins for the GitLab project is restricted to reduce the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that the maximum number of admins for the GitLab project is restricted.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that the maximum number of admins is restricted.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_admins | number | False | Maximum number of admins allowed in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md
new file mode 100644
index 000000000..39e99487e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Restrict Public Visibility in GitLab Organization
+title: Restrict Public Visibility in GitLab Organization
+---  
+# Restrict Public Visibility in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-allowed-visible-projects`  
+**Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.yaml)  
+**Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.rego)  
+**Labels:** Gitlab, Organization  
+
+Verify only allowed projects in the GitLab organization have public visibility.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/projects-visibility@v2
+with:
+  allowed_public:
+    - "Learn GitLab"
+    - "Scribe Gitlab Test"
+```
+
+## Description  
+This rule ensures that only allowed projects in the GitLab organization have public visibility.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that only allowed projects have public visibility.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_public | array | False | List of projects allowed to have public visibility in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md
new file mode 100644
index 000000000..7d2d36778
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Forbid Unused Tokens in GitLab Organization
+title: Forbid Unused Tokens in GitLab Organization
+---  
+# Forbid Unused Tokens in GitLab Organization  
+**Type:** Rule  
+**ID:** `gitlab-org-unused-tokens`  
+**Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.yaml)  
+**Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.rego)  
+**Labels:** Gitlab, Organization  
+
+Verify there are no unused GitLab organization tokens.
+
+:::note 
+This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/org/unused-tokens@v2
+with:
+  unused_for_days: 90
+```
+
+## Mitigation  
+Ensure that no GitLab organization tokens are unused to prevent service disruption.
+
+
+## Description  
+This rule ensures that no GitLab organization tokens are unused.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no tokens are unused.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=organization |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| unused_for_days | number | False | Number of days before a token is considered unused. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/_category_.json b/docs/configuration/initiatives/rules/gitlab/pipeline/_category_.json
new file mode 100644
index 000000000..a57065cbf
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/pipeline/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Pipeline",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md
new file mode 100644
index 000000000..7d6a7bc74
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: GitLab pipeline verify labels exist
+title: GitLab pipeline verify labels exist
+---  
+# GitLab pipeline verify labels exist  
+**Type:** Rule  
+**ID:** `gitlab-pipeline-verify-labels-exist`  
+**Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.yaml)  
+**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.rego)  
+**Labels:** Gitlab, Pipeline  
+
+Verify the pipeline has all required label keys and values.
+
+:::note 
+This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/pipeline/verify-labels-exist@v2
+with:
+  labels:
+    - "app.kubernetes.io/instance"
+```
+
+## Mitigation  
+Ensure that all required labels exist in the pipeline to reduce the risk of misconfiguration.
+
+
+## Description  
+This rule ensures that the pipeline has all required label keys and values.
+It performs the following steps:
+
+1. Checks the settings of the GitLab pipeline.
+2. Verifies that all required labels exist in the pipeline.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab pipeline resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pipeline |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| labels | array | True | List of labels to verify exist in the pipeline. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md
new file mode 100644
index 000000000..98db27834
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify GitLab Pipeline Labels
+title: Verify GitLab Pipeline Labels
+---  
+# Verify GitLab Pipeline Labels  
+**Type:** Rule  
+**ID:** `gitlab-pipeline-verify-labels`  
+**Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.yaml)  
+**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.rego)  
+**Labels:** Gitlab, Pipeline  
+
+Verify the pipeline includes all required label keys and values.
+
+:::note 
+This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/pipeline/verify-labels@v2
+with:
+  labels:
+    app.kubernetes.io/instance: "defaul1t"
+```
+
+## Mitigation  
+Ensure that all required labels exist in the pipeline to reduce the risk of misconfiguration.
+
+
+## Description  
+This rule ensures that the pipeline includes all required label keys and values.
+It performs the following steps:
+
+1. Checks the settings of the GitLab pipeline.
+2. Verifies that all required labels exist in the pipeline.
+2.1 Verify that all the label values match the expected values.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab pipeline resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pipeline |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| labels | object | True | List of labels to verify exist in the pipeline. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/_category_.json b/docs/configuration/initiatives/rules/gitlab/project/_category_.json
new file mode 100644
index 000000000..a88c9e5b1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Project",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md
new file mode 100644
index 000000000..6f377e608
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify Project Activity
+title: Verify Project Activity
+---  
+# Verify Project Activity  
+**Type:** Rule  
+**ID:** `gitlab-project-abandoned-project`  
+**Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.yaml)  
+**Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the GitLab project is active for a specified duration.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/abandoned-project@v2
+with:
+  inactive_for_days: 30
+```
+
+## Mitigation  
+Ensure that the GitLab project is active for the specified duration to prevent project abandonment.
+
+
+## Description  
+This rule ensures that the GitLab project is active for a specified duration.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the project has been active for the specified duration.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| inactive_for_days | number | False | Number of days the project has been inactive. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md
new file mode 100644
index 000000000..74c3cfa16
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Merge approval policy check for GitLab project
+title: Merge approval policy check for GitLab project
+---  
+# Merge approval policy check for GitLab project  
+**Type:** Rule  
+**ID:** `gitlab-project-merge-approval`  
+**Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.yaml)  
+**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.rego)  
+**Labels:** Blueprint, Gitlab, Project  
+
+Verify the project's merge approval policy complies with requirements.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/approvals-policy-check@v2
+with:
+  name: "All Members"
+  approvals_required_min: 2
+```
+
+## Mitigation  
+Ensure that the project's merge approval policy complies with requirements to prevent unauthorized merges.
+
+
+## Description  
+This rule ensures that the project's merge approval policy complies with requirements.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the project's merge approval policy matchinig the 'name' field.
+2.1. Verifies that the project's merge approval policy requires a minimum number of approvals as specified in the 'approvals_required_min' field.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| name | string | True | Name of the group or user that must approve the merge request. |
+| approvals_required_min | number | True | Minimum number of approvals required for merge requests. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md
new file mode 100644
index 000000000..1bcfa0201
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Restrict Approvers Per Merge Request
+title: Restrict Approvers Per Merge Request
+---  
+# Restrict Approvers Per Merge Request  
+**Type:** Rule  
+**ID:** `gitlab-project-approvers-per-merge-request`  
+**Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.yaml)  
+**Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/approvers-per-merge-request@v2
+with:
+  disable_overriding_approvers_per_merge_request: false
+```
+
+## Mitigation  
+Ensure that the binary field Disable Overriding Approvers Per Merge Request reduces the risk of unauthorized access by setting it to the specified value.
+
+
+## Description  
+This rule ensures that the binary field Disable Overriding Approvers Per Merge Request is set for the GitLab project.
+
+It performs the following steps:
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field Disable Overriding Approvers Per Merge Request is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| disable_overriding_approvers_per_merge_request | boolean | False | Whether to disable overriding approvers per merge request. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md
new file mode 100644
index 000000000..c7019dce3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Set Author Email Regex in GitLab Project
+title: Set Author Email Regex in GitLab Project
+---  
+# Set Author Email Regex in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-author-email-regex`  
+**Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.yaml)  
+**Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the `author_email_regex` for the GitLab project is set to the specified value.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/author-email-regex@v2
+with:
+  author_email_regex: ".*@mycompany.com"
+```
+
+## Mitigation  
+Ensure that the Author Email reduces the risk of unauthorized access by setting the `author_email_regex` field to the specified value.
+
+
+## Description  
+This rule ensures that the `author_email_regex` for the GitLab project is set to the specified value.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the Author Email matches the 'author_email_regex' field.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| author_email_regex | string | False | The regular expression for the author email. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md
new file mode 100644
index 000000000..9d242afec
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Check CWE Compliance
+title: Check CWE Compliance
+---  
+# Check CWE Compliance  
+**Type:** Rule  
+**ID:** `gitlab-project-check-cwe`  
+**Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.yaml)  
+**Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.rego)  
+**Labels:** Gitlab, Project  
+
+Verify that specified CWEs were not detected in the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/check-cwe@v2
+with:
+  cwe_value: "89"
+```
+
+## Mitigation  
+Ensure that the specified CWEs were not detected in the GitLab project to prevent vulnerabilities.
+
+
+## Description  
+This rule ensures that the specified CWEs were not detected in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the specified CWEs were not detected in the GitLab project.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| cwe_value | string | True | The CWE value to check for. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md
new file mode 100644
index 000000000..b96f49d86
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Ensure All Commits Are Signed in GitLab Project
+title: Ensure All Commits Are Signed in GitLab Project
+---  
+# Ensure All Commits Are Signed in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-signed-commits`  
+**Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.yaml)  
+**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.rego)  
+**Labels:** Gitlab, Project  
+
+Verify all commits in the GitLab project are signed.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/check-signed-commits@v2
+```
+
+## Mitigation  
+Ensure that all commits in the GitLab project are signed to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that all commits in the GitLab project are signed.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that all commits are signed.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md
new file mode 100644
index 000000000..da12d7582
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Require Code Owner Approval in GitLab Project
+title: Require Code Owner Approval in GitLab Project
+---  
+# Require Code Owner Approval in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-code-owner-approval`  
+**Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.yaml)  
+**Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.rego)  
+**Labels:** Gitlab, Project  
+
+Verify code owner approval is required for specific branches in the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/co-approval-required@v2
+with:
+  branch: "main"
+```
+
+## Mitigation  
+Require code owner approval for specific branches in the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that code owner approval is required for specific branches in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that code owner approval is required for the specified branch.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branch | string | True | The branch to require code owner approval. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md
new file mode 100644
index 000000000..93e5275b6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Restrict Commit Authors in GitLab Project
+title: Restrict Commit Authors in GitLab Project
+---  
+# Restrict Commit Authors in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-allowed-commit-authors`  
+**Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.yaml)  
+**Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify only GitLab project users in the Allowed List have commit author permissions.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commit-author-email-check@v2
+with:
+  allowed_authors:
+    - mail@example.com
+    - mail2@example.com
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have commit author permissions in the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have commit author permissions in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that only users in the Allowed List have commit author permissions.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_authors | array | False | List of users allowed to have commit author permissions in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md
new file mode 100644
index 000000000..94d088103
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Allowed Commit Authors in GitLab Project
+title: Allowed Commit Authors in GitLab Project
+---  
+# Allowed Commit Authors in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-allowed-commit-author-names`  
+**Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.yaml)  
+**Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify only users in the Allowed List author commits in the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commit-author-name-check@v2
+with:
+  allowed_authors:
+    - examplename
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List author commits in the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List author commits in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that only users in the Allowed List author commits.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_authors | array | False | List of users allowed to author commits in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md
new file mode 100644
index 000000000..c6f719d1d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Enable Commit Committer Check in GitLab Project
+title: Enable Commit Committer Check in GitLab Project
+---  
+# Enable Commit Committer Check in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-verify-commit_committer_check`  
+**Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.yaml)  
+**Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify `commit_committer_check` is enabled for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commit-committer-check@v2
+```
+
+## Mitigation  
+Enable `commit_committer_check` in the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that `commit_committer_check` is enabled for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `commit_committer_check` is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md
new file mode 100644
index 000000000..b9a2184b8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify Commit Message Format
+title: Verify Commit Message Format
+---  
+# Verify Commit Message Format  
+**Type:** Rule  
+**ID:** `gitlab-project-verify-commit_message_check`  
+**Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.yaml)  
+**Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify that commit messages in the GitLab project adhere to the specified format template.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commit-message-check@v2
+with:
+  commit_message_regex: ".*JIRA-\\d+.*"
+```
+
+## Mitigation  
+Ensure that commit messages adhere to the specified format template to maintain consistency and readability.
+
+
+## Description  
+This rule ensures that commit messages in the GitLab project adhere to the specified format template.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that commit messages adhere to the specified format template.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| commit_message_regex | string | True | The regular expression to match the commit message format. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md
new file mode 100644
index 000000000..7d482462a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Validate All Commits in GitLab Project
+title: Validate All Commits in GitLab Project
+---  
+# Validate All Commits in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-all-commits-validated`  
+**Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.yaml)  
+**Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.rego)  
+**Labels:** Gitlab, Project  
+
+Verify all commits in the GitLab project are validated.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commits-validated@v2
+```
+
+## Mitigation  
+Ensure that all commits in the GitLab project are validated to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that all commits in the GitLab project are validated.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that all commits are validated.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md
new file mode 100644
index 000000000..6cee634cd
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Allowed Committer Emails in GitLab Project
+title: Allowed Committer Emails in GitLab Project
+---  
+# Allowed Committer Emails in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-allowed-committer-emails`  
+**Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.yaml)  
+**Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify only users in the Allowed List use committer email addresses in the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/committer-email-check@v2
+with:
+  allowed_committers:
+    - mail@example.com
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List use committer email addresses in the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List use committer email addresses in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that only users in the Allowed List use committer email addresses.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_committers | array | False | List of email addresses allowed to use committer email addresses in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md
new file mode 100644
index 000000000..d296bed4e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Allowed Committer Names in GitLab Project
+title: Allowed Committer Names in GitLab Project
+---  
+# Allowed Committer Names in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-allowed-committer-names`  
+**Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.yaml)  
+**Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify only users in the Allowed List commit by name in the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/committer-name-check@v2
+with:
+  allowed_committers:
+    - somename
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List commit by name in the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List commit by name in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that only users in the Allowed List commit by name.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_committers | array | False | List of users allowed to commit by name in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md
new file mode 100644
index 000000000..91828aa07
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Enforce Critical Severity Limit
+title: Enforce Critical Severity Limit
+---  
+# Enforce Critical Severity Limit  
+**Type:** Rule  
+**ID:** `gitlab-project-critical-severity-limit`  
+**Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.yaml)  
+**Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the maximum allowed critical severity alerts for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/critical-severity-limit@v2
+with:
+  max_allowed_vulnerability_count: 0
+```
+
+## Mitigation  
+Ensure that the maximum allowed critical severity alerts for the GitLab project is enforced to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that the maximum allowed critical severity alerts for the GitLab project is enforced.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the maximum allowed critical severity alerts is enforced.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_allowed_vulnerability_count | number | False | Maximum allowed critical severity alerts for the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md
new file mode 100644
index 000000000..13345c71e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Check Description Substring
+title: Check Description Substring
+---  
+# Check Description Substring  
+**Type:** Rule  
+**ID:** `gitlab-project-description-substring-check`  
+**Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.yaml)  
+**Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/description-substring-check@v2
+with:
+  pattern: "(?i)insdput"
+```
+
+## Mitigation  
+Ensure that the specified substring is not found in the description attribute of vulnerabilities to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that a specific substring is not found in the description attribute of vulnerabilities for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the specified substring is not found in the description attribute of vulnerabilities.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| pattern | string | False | The substring to search for in the description attribute of vulnerabilities. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md
new file mode 100644
index 000000000..035933d59
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Disallow Banned Approvers
+title: Disallow Banned Approvers
+---  
+# Disallow Banned Approvers  
+**Type:** Rule  
+**ID:** `gitlab-project-disallowed-banned-approvers`  
+**Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.yaml)  
+**Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.rego)  
+**Labels:** Gitlab, Project  
+
+Verify approvers in the GitLab project are not on the banned list.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/disallowed-banned-approvers@v2
+with:
+  banned_list:
+    - user1
+    - user2
+```
+
+## Mitigation  
+Ensure that approvers in the GitLab project are not on the banned list to prevent unauthorized approvals.
+
+
+## Description  
+This rule ensures that approvers in the GitLab project are not on the banned list.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that approvers are not on the banned list.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| banned_list | array | False | List of users banned from approving in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md
new file mode 100644
index 000000000..c2e7d5cf5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Disallow Force Push in GitLab Project
+title: Disallow Force Push in GitLab Project
+---  
+# Disallow Force Push in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-disallow-force-push`  
+**Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.yaml)  
+**Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.rego)  
+**Labels:** Gitlab, Project  
+
+Verify force pushes in the GitLab project are disallowed to maintain repository integrity.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/force-push-protection@v2
+with:
+  branch: "main"
+```
+
+## Mitigation  
+Ensure that force pushes in the GitLab project are disallowed to maintain repository integrity.
+
+
+## Description  
+This rule ensures that force pushes in the GitLab project are disallowed to maintain repository integrity.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that force pushes are disallowed.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branch | string | False | The branch to disallow force pushes. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md
new file mode 100644
index 000000000..f88eaf51d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Enforce Medium Severity Limit
+title: Enforce Medium Severity Limit
+---  
+# Enforce Medium Severity Limit  
+**Type:** Rule  
+**ID:** `gitlab-project-medium-severity-limit`  
+**Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.yaml)  
+**Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the maximum allowed medium severity alerts for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/medium-severity-limit@v2
+with:
+  max_allowed_specific_severity: 0
+```
+
+## Mitigation  
+Ensure that the maximum allowed medium severity alerts for the GitLab project is enforced to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that the maximum allowed medium severity alerts for the GitLab project is enforced.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the maximum allowed medium severity alerts is enforced.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_allowed_specific_severity | number | False | Maximum allowed medium severity alerts for the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md
new file mode 100644
index 000000000..71b9b679f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Enable Member Check for GitLab Project
+title: Enable Member Check for GitLab Project
+---  
+# Enable Member Check for GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-verify-member_check`  
+**Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.yaml)  
+**Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify `member_check` is enabled for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/member-check@v2
+```
+
+## Mitigation  
+Ensure that Member Check is enabled for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that `member_check` is enabled for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `member_check` is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md
new file mode 100644
index 000000000..a403b5785
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Enforce Merge Access Level Policy for GitLab Project
+title: Enforce Merge Access Level Policy for GitLab Project
+---  
+# Enforce Merge Access Level Policy for GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-merge-access-level`  
+**Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.yaml)  
+**Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the GitLab project's merge access level complies with requirements.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/merge-access-level@v2
+with:
+  branch: "main"
+  access_level: 30
+  access_level_description: "Maintainers"
+```
+
+## Mitigation  
+Ensure that the GitLab project's merge access level complies with requirements to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that the GitLab project's merge access level complies with requirements.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. For scoped branchs, verifies that the merge access level complies with the specified requirements.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branch | string | False | The branch to enforce merge access level policy. |
+| access_level | number | False | The access level to enforce for merge access level policy. |
+| access_level_description | string | False | The access level description to enforce for merge access level policy. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md
new file mode 100644
index 000000000..7932ba186
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Disable Author Approval for Merge Requests in GitLab
+title: Disable Author Approval for Merge Requests in GitLab
+---  
+# Disable Author Approval for Merge Requests in GitLab  
+**Type:** Rule  
+**ID:** `gitlab-project-merge-requests-author-approval`  
+**Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.yaml)  
+**Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the binary field `merge_requests_author_approval` is set for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/merge-requests-author-approval@v2
+with:
+  merge_requests_author_approval: true
+```
+
+## Mitigation  
+Ensure that the binary field `merge_requests_author_approval` is set for the GitLab project to prevent unauthorized approvals.
+
+
+## Description  
+This rule ensures that the binary field Merge Requests Author Approval is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field Merge Requests Author Approval is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| merge_requests_author_approval | boolean | False | The binary field to enforce for merge requests author approval. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md
new file mode 100644
index 000000000..4a8d094d4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Disable Committers' Approval for Merge Requests in GitLab
+title: Disable Committers' Approval for Merge Requests in GitLab
+---  
+# Disable Committers' Approval for Merge Requests in GitLab  
+**Type:** Rule  
+**ID:** `gitlab-project-merge-requests-disable-committers-approval`  
+**Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml)  
+**Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego)  
+**Labels:** Gitlab, Project  
+
+Verify `merge_requests_disable_committers_approval` is set for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/merge-requests-disable-committers-approval@v2
+with:
+  merge_requests_disable_committers_approval: false
+```
+
+## Mitigation  
+Ensure that the binary Merge Requests Disable Committers Approval field is set for the GitLab project to prevent unauthorized approvals.
+
+
+## Description  
+This rule ensures that the binary field Merge Requests Disable Committers Approval is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field `merge_requests_disable_committers_approval` is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| merge_requests_disable_committers_approval | boolean | False | The binary field to enforce for merge requests committers' approval. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md
new file mode 100644
index 000000000..c55a94233
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Check Message Substring
+title: Check Message Substring
+---  
+# Check Message Substring  
+**Type:** Rule  
+**ID:** `gitlab-project-message-substring-check`  
+**Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.yaml)  
+**Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/message-substring-check@v2
+with:
+  pattern: "(?i)dghd"
+```
+
+## Mitigation  
+Ensure that the specified substring is not found in the message attribute of vulnerabilities for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that a specific substring is not found in the message attribute of vulnerabilities for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the specified substring is not found in the message attribute of vulnerabilities.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| pattern | string | True | The pattern to search for in the message attribute of vulnerabilities. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md
new file mode 100644
index 000000000..5b6640260
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Enable Secrets Prevention in GitLab Project
+title: Enable Secrets Prevention in GitLab Project
+---  
+# Enable Secrets Prevention in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-verify-prevent_secrets`  
+**Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.yaml)  
+**Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify `prevent_secrets` is enabled for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/prevent-secrets-check@v2
+```
+
+## Mitigation  
+Ensure that Secrets Prevention is enabled for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that `prevent_secrets` is enabled for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `prevent_secrets` is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md
new file mode 100644
index 000000000..f3a63ec48
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Protect CI Secrets in GitLab Project
+title: Protect CI Secrets in GitLab Project
+---  
+# Protect CI Secrets in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-protect-ci-secrets`  
+**Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.yaml)  
+**Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.rego)  
+**Labels:** Gitlab, Project  
+
+Verify secrets in the GitLab project are not shared.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/protect-ci-secrets@v2
+with:
+  pattern: "(?i)(token|secret)"
+```
+
+## Mitigation  
+Ensure that secrets in the GitLab project are not shared to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that secrets in the GitLab project are not shared.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that secrets are not shared.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| pattern | string | False | The pattern to match secrets. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md
new file mode 100644
index 000000000..035c0b61c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Set Push Access Level in GitLab Project
+title: Set Push Access Level in GitLab Project
+---  
+# Set Push Access Level in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-push-access-level`  
+**Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.yaml)  
+**Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the GitLab project's push access level policy complies with requirements.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/push-access-level@v2
+with:
+  branch: "main"
+  access_level: 30
+  access_level_description: "Maintainers"
+```
+
+## Mitigation  
+Ensure that the GitLab project's push access level complies with requirements to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that the GitLab project's push access level complies with requirements.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. For scoped branchs, verifies that the push access level complies with the specified requirements.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.  
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branch | string | False | The branch to enforce push access level policy. |
+| access_level | number | False | The access level to enforce for push access level policy. |
+| access_level_description | string | False | The access level description to enforce for push access level policy. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md
new file mode 100644
index 000000000..10e0073e6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Set Push Rules for GitLab Project
+title: Set Push Rules for GitLab Project
+---  
+# Set Push Rules for GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-verify-push_rules`  
+**Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.yaml)  
+**Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.rego)  
+**Labels:** Gitlab, Project  
+
+Verify push rules are set for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/push-rules-set@v2
+```
+
+## Mitigation  
+Ensure that push rules are set for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that push rules are set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that push rules are set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md
new file mode 100644
index 000000000..c78fa0af3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Reject Unsigned Commits in GitLab Project
+title: Reject Unsigned Commits in GitLab Project
+---  
+# Reject Unsigned Commits in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-disallow-unsigned-commits`  
+**Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.yaml)  
+**Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.rego)  
+**Labels:** Blueprint, Gitlab, Project  
+
+Verify `reject_unsigned_commits` is enabled for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/reject-unsigned-commits@v2
+```
+
+## Mitigation  
+Ensure that Reject Unsigned Commits is enabled for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that `reject_unsigned_commits` is enabled for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `reject_unsigned_commits` is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md
new file mode 100644
index 000000000..2ad69415a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Require Password for Approvals in GitLab Project
+title: Require Password for Approvals in GitLab Project
+---  
+# Require Password for Approvals in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-require-password-to-approve`  
+**Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.yaml)  
+**Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the binary field `require_password_to_approve` is set for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/require-password-to-approve@v2
+with:
+  require_password_to_approve: true
+```
+
+## Mitigation  
+Ensure that the binary field `require_password_to_approve` is set for the GitLab project to prevent unauthorized approvals.
+
+
+## Description  
+This rule ensures that the binary field `require_password_to_approve` is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field `require_password_to_approve` is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| require_password_to_approve | boolean | False | The binary field to enforce for requiring password to approve. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md
new file mode 100644
index 000000000..506521ccd
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Require Minimal Approvers in GitLab Project
+title: Require Minimal Approvers in GitLab Project
+---  
+# Require Minimal Approvers in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-required-minimal-approvers`  
+**Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.yaml)  
+**Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the required number of approvers for the GitLab project is met.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/required-minimal-approvers@v2
+```
+
+## Mitigation  
+Ensure that the required number of approvers for the GitLab project is met to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that the required number of approvers for the GitLab project is met.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the required number of approvers is met.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md
new file mode 100644
index 000000000..b93761d69
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Reset Approvals on Push in GitLab Project
+title: Reset Approvals on Push in GitLab Project
+---  
+# Reset Approvals on Push in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-reset-pprovals-on-push`  
+**Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.yaml)  
+**Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.rego)  
+**Labels:** Gitlab, Project  
+
+Verify `reset_approvals_on_push` is set for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/reset-pprovals-on-push@v2
+with:
+  reset_approvals_on_push: true
+```
+
+## Mitigation  
+Ensure that the binary field `reset_approvals_on_push` is set for the GitLab project to prevent unauthorized approvals.
+
+
+## Description  
+This rule ensures that the binary field `reset_approvals_on_push` is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field `reset_approvals_on_push` is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| reset_approvals_on_push | boolean | False | The binary field to enforce for resetting approvals on push. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md
new file mode 100644
index 000000000..8587693d6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Ensure SAST Scanning Passes
+title: Ensure SAST Scanning Passes
+---  
+# Ensure SAST Scanning Passes  
+**Type:** Rule  
+**ID:** `gitlab-project-sast-scan-pass`  
+**Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.yaml)  
+**Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.rego)  
+**Labels:** Gitlab, Project  
+
+Verify SAST scanning is successful for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/sast-scan-pass@v2
+```
+
+## Mitigation  
+Ensure that SAST scanning is successful for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that SAST scanning is successful for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that SAST scanning is successful.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md
new file mode 100644
index 000000000..97831a147
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Run SAST Scanning in GitLab Project
+title: Run SAST Scanning in GitLab Project
+---  
+# Run SAST Scanning in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-sast-scanning`  
+**Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.yaml)  
+**Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.rego)  
+**Labels:** Gitlab, Project  
+
+Verify SAST scanning is performed for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/sast-scanning@v2
+```
+
+## Mitigation  
+Ensure that SAST scanning is performed for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that SAST scanning is performed for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that SAST scanning is performed.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md
new file mode 100644
index 000000000..76a61169a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Ensure Secrets Scanning Passes
+title: Ensure Secrets Scanning Passes
+---  
+# Ensure Secrets Scanning Passes  
+**Type:** Rule  
+**ID:** `gitlab-project-secrets-scan-pass`  
+**Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.yaml)  
+**Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.rego)  
+**Labels:** Gitlab, Project  
+
+Verify secrets scanning is successful for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/secrets-scan-pass@v2
+```
+
+## Mitigation  
+Ensure that secrets scanning is successful for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that secrets scanning is successful for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that secrets scanning is successful.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md
new file mode 100644
index 000000000..f11093603
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Run Secrets Scanning in GitLab Project
+title: Run Secrets Scanning in GitLab Project
+---  
+# Run Secrets Scanning in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-secrets-scanning`  
+**Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.yaml)  
+**Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.rego)  
+**Labels:** Gitlab, Project  
+
+Verify secrets scanning is performed for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/secrets-scanning@v2
+```
+
+## Mitigation  
+Ensure that secrets scanning is performed for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that secrets scanning is performed for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that secrets scanning is performed.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md
new file mode 100644
index 000000000..162927a75
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Restrict Selective Code Owner Removals in GitLab
+title: Restrict Selective Code Owner Removals in GitLab
+---  
+# Restrict Selective Code Owner Removals in GitLab  
+**Type:** Rule  
+**ID:** `gitlab-project-selective-code-owner-removals`  
+**Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.yaml)  
+**Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.rego)  
+**Labels:** Gitlab, Project  
+
+Verify `selective_code_owner_removals` is set for the GitLab project.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/selective-code-owner-removals@v2
+with:
+  selective_code_owner_removals: true
+```
+
+## Mitigation  
+Ensure that `selective_code_owner_removals` is set for the GitLab project to prevent unauthorized changes.
+
+
+## Description  
+This rule ensures that `selective_code_owner_removals` is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `selective_code_owner_removals` is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| selective_code_owner_removals | boolean | True | Indicates whether `selective_code_owner_removals` is set for the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md
new file mode 100644
index 000000000..e05aa11be
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Set Visibility Level in GitLab Project
+title: Set Visibility Level in GitLab Project
+---  
+# Set Visibility Level in GitLab Project  
+**Type:** Rule  
+**ID:** `gitlab-project-project-visibility-level`  
+**Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.yaml)  
+**Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.rego)  
+**Labels:** Gitlab, Project  
+
+Verify the GitLab project's visibility matches the required level.
+
+:::note 
+This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: gitlab/project/visibility-check@v2
+with:
+  visibility: private
+```
+
+## Mitigation  
+Ensure that the GitLab project's visibility matches the required level to prevent unauthorized access.
+
+
+## Description  
+This rule ensures that the GitLab project's visibility matches the required level.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the visibility level matches the required level.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| visibility | string | True | The visibility level to enforce for the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/images/_category_.json b/docs/configuration/initiatives/rules/images/_category_.json
new file mode 100644
index 000000000..fb18a4fc4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Images",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md
new file mode 100644
index 000000000..7e1da7e5d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md
@@ -0,0 +1,66 @@
+---
+sidebar_label: Allowed Base Image
+title: Allowed Base Image
+---  
+# Allowed Base Image  
+**Type:** Rule  
+**ID:** `images-allowed-base-image`  
+**Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.yaml)  
+**Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.rego)  
+**Labels:** SBOM, Images  
+
+Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by target and product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/allowed-base-image@v2
+with:
+  approved_sources:
+    - "docker.io/library/*"
+    - "docker.io/my_org/*"
+```
+
+## Mitigation  
+Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern.
+
+
+## Description  
+This rule examines the SBOM evidence for a container image, focusing on components in the "container" group that represent base images.
+A base image is identified by the presence of a property whose name ends with "isbaseimage" (case-insensitive) and whose value is "true".
+For each detected base image, the rule verifies that its name matches one of the approved source patterns defined in the configuration 
+(via `with.approved_sources`). If a base image does not match any of the approved patterns, it is flagged as invalid. If no base image data 
+is found, a violation is recorded indicating that the necessary base image information is missing.
+
+**Evidence Requirements:**
+
+- The SBOM evidence must be provided in the `cyclonedx-json` format.
+- The SBOM should include a `metadata.component.properties` array containing properties that identify base images.
+- The approved source patterns must be specified in the `with.approved_sources` parameter.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| approved_sources | array | False | A list of approved base image  pattern. |
+
diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md
new file mode 100644
index 000000000..9fa8c6fee
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md
@@ -0,0 +1,66 @@
+---
+sidebar_label: Allowed Main Image Source
+title: Allowed Main Image Source
+---  
+# Allowed Main Image Source  
+**Type:** Rule  
+**ID:** `images-allowed-image-source`  
+**Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.yaml)  
+**Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.rego)  
+**Labels:** SBOM, Images  
+
+Ensures the main container image referenced in the SBOM is from an approved source.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by target and product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/allowed-image-source@v2
+with:
+  approved_sources:
+    - "docker.io/library/*"
+    - "docker.io/my_org/*"
+```
+
+## Mitigation  
+Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used.
+
+
+## Description  
+This rule extracts the main image’s name and version from the SBOM evidence and verifies that it originates from an approved source.
+It does so by comparing the image name against a list of approved source patterns provided via the configuration (`with.approved_sources`).
+The matching is performed using a case-insensitive, anchored regex.
+
+- If one or more approved source patterns are provided and the image name matches at least one pattern, the image is considered compliant.
+- If the image name does not match any approved source, or if no approved source patterns are provided, a violation is recorded.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a `metadata.component` section containing the main image’s `name` and `version` fields.
+- The approved source patterns must be specified in `with.approved_sources`.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| approved_sources | array | False | A list of approved Image source patterns. |
+
diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md
new file mode 100644
index 000000000..68d9c841c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/banned-ports.md
@@ -0,0 +1,69 @@
+---
+sidebar_label: Banned Ports
+title: Banned Ports
+---  
+# Banned Ports  
+**Type:** Rule  
+**ID:** `images-banned-ports`  
+**Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.yaml)  
+**Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.rego)  
+**Labels:** SBOM, Images  
+
+Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by target and product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/banned-ports@v2
+with:
+  banned_ports:
+    - port: "3000"
+      protocol: "tcp"
+    - port: "8080"
+      protocol: "tcp"
+```
+
+## Mitigation  
+Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access  and potential exploitation. This check ensures that only images with approved port configurations are deployed.
+
+
+## Description  
+This rule evaluates the CycloneDX SBOM evidence for a container image to verify that no disallowed ports are exposed.
+It performs the following steps:
+
+1. Retrieves all properties from the SBOM's `metadata.component.properties` whose names start with "imageExposedPorts_".
+2. Expects each property value to be formatted as "port/protocol" (e.g., "3000/tcp") and splits the value into its components.
+3. Compares each exposed port against the list of banned ports provided in the configuration (`with.banned_ports`).
+   - If a banned port (and, if specified, protocol) is detected, the rule flags it as a violation.
+4. If no banned ports list is provided, the rule also fails.
+
+**Evidence Requirements:**
+
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a `metadata.component.properties` array with entries for exposed ports.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| banned_ports | array | False | A list of banned ports and protocols. Each entry should be a dictionary with 'port' and 'protocol' keys. |
+
diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md
new file mode 100644
index 000000000..1c667f1a5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/banned-users.md
@@ -0,0 +1,65 @@
+---
+sidebar_label: Disallow Specific Users in SBOM
+title: Disallow Specific Users in SBOM
+---  
+# Disallow Specific Users in SBOM  
+**Type:** Rule  
+**ID:** `sbom-disallowed-users`  
+**Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.yaml)  
+**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.rego)  
+**Labels:** SBOM, Image  
+
+Verify specific users are not allowed in an SBOM.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by target and product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/banned-users@v2
+with:
+  users:
+    - root
+```
+
+## Mitigation  
+Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used.
+
+
+## Description  
+This rule inspects the CycloneDX SBOM evidence for a container image to ensure that the image is not configured 
+to run with a banned default user. It does so by examining the `metadata.component.properties` array for a property 
+with the name "user". The value of this property is then compared against a list of disallowed users specified in 
+the configuration (via `with.users`). If the image is found to be running as a banned user (for example, "root"), 
+a violation is recorded.
+
+**Evidence Requirements:**
+
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a `metadata.component.properties` array with an entry where the property name is "user".
+- The disallowed user list (e.g., ["root"]) must be provided in the `with.users` parameter.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| users | array | False | A list of disallowed users. Each entry should be a string representing a username. |
+
diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md
new file mode 100644
index 000000000..4c4de8549
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md
@@ -0,0 +1,54 @@
+---
+sidebar_label: Restrict Build Scripts
+title: Restrict Build Scripts
+---  
+# Restrict Build Scripts  
+**Type:** Rule  
+**ID:** `images-disallowed-build-script`  
+**Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.yaml)  
+**Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.rego)  
+**Labels:** SBOM, Images  
+
+Verify no build scripts commands appear in block list.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: images/blocklist-build-scripts@v2
+with:
+  blocklist:
+  - "wget"
+  - "curl"
+```
+
+## Mitigation  
+Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain.
+
+
+## Description  
+This rule inspects the SBOM (in CycloneDX JSON format) for each Layer component and specifically looks for a property named "CreatedBy". 
+It then checks whether the value of this property contains any substrings specified in the 'blocklist' parameter. 
+If a match is found, the rule generates a violation indicating that a disallowed build script command was used during the build process.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| blocklist | array | False | A list of disallowed build script commands. Each entry should be a string representing a command or substring. |
+
diff --git a/docs/configuration/initiatives/rules/images/blocklist-user.md b/docs/configuration/initiatives/rules/images/blocklist-user.md
new file mode 100644
index 000000000..9acd11cac
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/blocklist-user.md
@@ -0,0 +1,38 @@
+---
+sidebar_label: Blocklist Container User
+title: Blocklist Container User
+---  
+# Blocklist Container User  
+**Type:** Rule  
+**ID:** `images-blocklist-user`  
+**Uses:** `images/blocklist-user@v2/rules`  
+**Source:** [v2/rules/images/blocklist-user.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.yaml)  
+**Rego Source:** [blocklist-user.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.rego)  
+**Labels:** SBOM, Images  
+
+Ensures that the container image does not use a user in the blocklist.
+We look for a SBOM property named "user" in metadata.component.properties. 
+If it matches any username from the 'users' list, we fail.
+
+
+:::tip 
+Rule Result will be set as 'open' if evidence is missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+his rule requires evaluation with a target; without one, the rule will be **disabled**.  
+::: 
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| users | [] |
diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md
new file mode 100644
index 000000000..86f385186
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md
@@ -0,0 +1,51 @@
+---
+sidebar_label: Registry Connection HTTPS
+title: Registry Connection HTTPS
+---  
+# Registry Connection HTTPS  
+**Type:** Rule  
+**ID:** `images-registry-https-check`  
+**Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.yaml)  
+**Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.rego)  
+**Labels:** Registry, Images  
+
+Checks if the container's registry scheme is HTTPS
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/enforce-https-registry@v2
+```
+
+## Description  
+This rule examines the CycloneDX SBOM evidence for a container image to verify that the registry connection
+is secure. It does so by scanning the `metadata.component.properties` array for a property named 
+'registry_scheme'. If the value of this property is exactly 'https', the rule passes; otherwise, it fails,
+indicating that the image may have been pulled from an insecure registry.
+
+**Evidence Requirements:**
+
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM should include a `metadata.component.properties` array with an entry for 'registry_scheme'.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['product', 'target'] |
+
diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md
new file mode 100644
index 000000000..505367584
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Forbid Large Images
+title: Forbid Large Images
+---  
+# Forbid Large Images  
+**Type:** Rule  
+**ID:** `images-project-large-image`  
+**Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.yaml)  
+**Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.rego)  
+**Labels:** SBOM, Images  
+
+Verify the image size is below the specified threshold.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: images/forbid-large-images@v2
+with:
+  max_size: 77819980
+```
+
+## Mitigation  
+Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities.
+
+
+## Description  
+This rule inspects the CycloneDX SBOM evidence for container images. It searches through the SBOM's components
+to locate a component belonging to the "layer" group where a property named "size" is defined. The rule specifically
+looks for the size property when the associated "index" property is "0" (which typically represents the overall image size).
+The extracted size is then converted to a numeric value and compared against the maximum size specified in the rule's configuration (`max_size`).
+
+- If the image size is less than or equal to the specified `max_size`, the rule passes and the image is considered acceptable.
+- If the image size exceeds the threshold, a violation is recorded with a message indicating the actual image size and the maximum allowed size.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in the `cyclonedx-json` format.
+- The SBOM must include a component in the "layer" group with a "size" property, and an "index" property set to "0".
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_size | integer | True | The maximum allowed image size in bytes. |
+
diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md
new file mode 100644
index 000000000..7e9bc6b60
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Fresh Base Image
+title: Fresh Base Image
+---  
+# Fresh Base Image  
+**Type:** Rule  
+**ID:** `images-fresh-base-image`  
+**Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.yaml)  
+**Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.rego)  
+**Labels:** SBOM, Images  
+
+Verifies that each base image is not older than the specified threshold (max_days) from its creation date.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by target and product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/fresh-base-image@v2
+with:
+  max_days: 183
+```
+
+## Mitigation  
+Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security.
+
+
+## Description  
+This rule processes the CycloneDX SBOM evidence for a container image to verify that its base image remains fresh. 
+It identifies base image components by locating properties whose names end with "isbaseimage" (case-insensitive) and have a value of "true". 
+The rule then extracts the "created" timestamp from these components and calculates the image’s age against the allowed threshold specified in `with.max_days`. 
+If any base image is older than the allowed age, or if no base image data is found, the rule records a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in CycloneDX JSON format.
+- The SBOM should include a `metadata.component.properties` array with properties for base image identification and creation timestamp.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | integer | True | The maximum allowed age of the base image in days. |
+
diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md
new file mode 100644
index 000000000..2c9feb853
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/fresh-image.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Fresh Image
+title: Fresh Image
+---  
+# Fresh Image  
+**Type:** Rule  
+**ID:** `fresh-image`  
+**Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.yaml)  
+**Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.rego)  
+**Labels:** SBOM, Images  
+
+Verify the image is not older than the specified threshold.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by target and product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/fresh-image@v2
+with:
+  max_days: 183
+```
+
+## Mitigation  
+Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time.
+
+
+## Description  
+This rule extracts the Image creation timestamp from the SBOM evidence. It searches for a property named "created" 
+within the image's metadata (specifically under `metadata.component.properties`). The creation timestamp is parsed using RFC 3339.
+
+The rule compares the current time with the sum of the creation time and the maximum allowed age (by days). If the current time exceeds this sum, 
+the rule flags the image as too old and generates a violation with details on the calculated maximum allowed time.
+
+### **Evidence Requirements**
+- Evidence must be provided in the `cyclonedx-json` format.
+- The SBOM must contain a component under `metadata.component.properties` with a property named "created" in valid RFC 3339 format.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | integer | True | The maximum allowed age of the image in days. |
+
diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md
new file mode 100644
index 000000000..91858cd0a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/image-signed.md
@@ -0,0 +1,69 @@
+---
+sidebar_label: Require Signed Container Image
+title: Require Signed Container Image
+---  
+# Require Signed Container Image  
+**Type:** Rule  
+**ID:** `images-require-signed-image`  
+**Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.yaml)  
+**Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.rego)  
+**Labels:** Images, Blueprint  
+
+Enforces that container images (target_type=container) are cryptographically signed.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/image-signed@v2
+with:
+  identity:
+    emails:
+    - bob@company.com
+    - alice@company.com
+  skip_image_regex:
+  - .*alpine.*
+```
+
+## Mitigation  
+Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities.
+
+
+## Description  
+This rule evaluates the evidence for a container image to determine if it is properly signed. It checks the 
+environment field in the evidence to verify that the `content_type` is set to "attest-cyclonedx-json". If the 
+image name matches any pattern specified in `with.skip_image_regex`, the signature check is skipped, allowing flexibility 
+for images that do not require a signature. Otherwise, if the evidence does not indicate a valid signature, the rule fails.
+
+**Evidence Requirements:**
+
+- Evidence must be provided in CycloneDX JSON format with a `content_body_type` of "cyclonedx-json".
+- The evidence environment must include a `content_type` field that indicates the report is signed (i.e., "attest-cyclonedx-json").
+- The `with.skip_image_regex` parameter allows specifying patterns (e.g., "alpine") to bypass the signature requirement for certain images. 
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| target_type | container |
+| signed | False |
+| filter-by | ['product', 'target'] |
+| content_body_type | cyclonedx-json |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| identity | object | False | Identity information for the signers |
+| skip_image_regex | array | False | Patterns to bypass the signature requirement for certain images |
+
diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md
new file mode 100644
index 000000000..37469aad5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md
@@ -0,0 +1,54 @@
+---
+sidebar_label: Require Healthcheck
+title: Require Healthcheck
+---  
+# Require Healthcheck  
+**Type:** Rule  
+**ID:** `images-require-healthcheck`  
+**Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.yaml)  
+**Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.rego)  
+**Labels:** SBOM, Images  
+
+Checks that the container image includes at least one healthcheck property.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by target and product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: images/require-healthcheck@v2
+```
+
+## Mitigation  
+Ensures that container images define a HEALTHCHECK instruction so that the runtime environment  can monitor and manage container health. This minimizes the risk of undetected failures at runtime.
+
+
+## Description  
+This rule examines the CycloneDX SBOM evidence for a container image to verify that a healthcheck is defined.
+It does so by scanning the `metadata.component.properties` array for any property whose name, when lowercased, 
+starts with "imagehealthcheck_". If at least one such property is found, the image is considered compliant; 
+otherwise, a violation is recorded indicating a missing healthcheck.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM should include a `metadata.component.properties` array with entries that define healthcheck instructions.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md
new file mode 100644
index 000000000..59ba82bba
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md
@@ -0,0 +1,46 @@
+---
+sidebar_label: Disallow Container Shell Entrypoint
+title: Disallow Container Shell Entrypoint
+---  
+# Disallow Container Shell Entrypoint  
+**Type:** Rule  
+**ID:** `images-disallow-shell-access`  
+**Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.yaml)  
+**Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.rego)  
+**Labels:** SBOM, Images  
+
+Verify the container image disallows shell entrypoint.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: images/restrict-shell-entrypoint@v2
+```
+
+## Mitigation  
+Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers.
+### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format.   - The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint".  
+
+
+## Description  
+This rule ensures that container images do not allow shell access by verifying their configured entrypoint.  
+Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions.  
+This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash').  
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md
new file mode 100644
index 000000000..d039f4bb3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md
@@ -0,0 +1,66 @@
+---
+sidebar_label: Require Image Labels
+title: Require Image Labels
+---  
+# Require Image Labels  
+**Type:** Rule  
+**ID:** `required-image-labels`  
+**Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.yaml)  
+**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.rego)  
+**Labels:** SBOM, Images  
+
+Verify the image has the specified labels.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: images/verify-labels-exist@v2
+with:
+  labels:
+    - "org.opencontainers.image.created"
+    - "org.opencontainers.image.revision"
+    - "org.opencontainers.image.title"
+    - "org.opencontainers.image.vendor"
+    - "org.opencontainers.image.version"
+```
+
+## Mitigation  
+Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards.
+
+
+## Description  
+This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label 
+(as defined in the `with.labels` parameter) exists with the correct value.
+
+1. The rule iterates over the list of required labels provided in the `with.labels` configuration.
+2. For each required label, it examines the `metadata.component.properties` array in the SBOM.
+3. It looks for a property where the name starts with "label_" and ends with the required label key, and
+   where the property value matches the expected value.
+4. If such a property is not found, a violation is recorded with the missing label and expected value details.
+
+### **Evidence Requirements**
+- Evidence must be provided in the `cyclonedx-json` format.
+- The SBOM should include a `metadata.component.properties` array that contains label information.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| labels | array | False | A list of required labels. |
+
diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md
new file mode 100644
index 000000000..654c419da
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/verify-labels.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Verify Image Labels
+title: Verify Image Labels
+---  
+# Verify Image Labels  
+**Type:** Rule  
+**ID:** `image-labels`  
+**Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.yaml)  
+**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.rego)  
+**Labels:** SBOM, Images  
+
+Verify specified labels key-value pairs exist in the image.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: images/verify-labels@v2
+with:
+  labels:
+    - "org.opencontainers.image.vendor=my_vendor"
+```
+
+## Mitigation  
+Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards.
+
+
+## Description  
+This rule checks the CycloneDX SBOM evidence for the container image to verify that each 
+required label (as defined in the `with.labels` parameter) exists with the correct value.
+
+1. The rule iterates over the list of required labels provided in the `with.labels` configuration.
+2. For each required label, it examines the `metadata.component.properties` array in the SBOM.
+3. It looks for a property where the name starts with "label_" and ends with the required label key, and
+   where the property value matches the expected value.
+4. If such a property is not found, a violation is recorded with the missing label and expected value details.
+
+### **Evidence Requirements**
+- Evidence must be provided in the `cyclonedx-json` format.
+- The SBOM should include a `metadata.component.properties` array that contains label information.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| labels | array | False | A list of required labels. |
+
diff --git a/docs/configuration/initiatives/rules/jenkins/_category_.json b/docs/configuration/initiatives/rules/jenkins/_category_.json
new file mode 100644
index 000000000..a1e606da6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Jenkins",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/jenkins/folder/_category_.json b/docs/configuration/initiatives/rules/jenkins/folder/_category_.json
new file mode 100644
index 000000000..5a7c99815
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/folder/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Folder",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md
new file mode 100644
index 000000000..5061c669c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Exposed Credentials
+title: Verify Exposed Credentials
+---  
+# Verify Exposed Credentials  
+**Type:** Rule  
+**ID:** `jenkins-exposed-credentials`  
+**Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.yaml)  
+**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.rego)  
+**Labels:** Jenkins, Folder  
+
+Verify there are no exposed credentials.
+
+:::note 
+This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: jenkins/folder/exposed-credentials@v2
+```
+
+## Mitigation  
+Ensure that there are no exposed credentials in the Jenkins folder to reduce the risk of unauthorized access.
+
+
+## Description  
+This rule ensures that there are no exposed credentials in the Jenkins folder.
+It performs the following steps:
+
+1. Checks the Jenkins folder for exposed credentials.
+2. Verifies that there are no exposed credentials.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins folder resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=folder |
+
diff --git a/docs/configuration/initiatives/rules/jenkins/instance/_category_.json b/docs/configuration/initiatives/rules/jenkins/instance/_category_.json
new file mode 100644
index 000000000..194968062
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/instance/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Instance",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md
new file mode 100644
index 000000000..35e412de4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md
@@ -0,0 +1,58 @@
+---
+sidebar_label: Verify Inactive Users
+title: Verify Inactive Users
+---  
+# Verify Inactive Users  
+**Type:** Rule  
+**ID:** `jenkins-inactive-users`  
+**Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.yaml)  
+**Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.rego)  
+**Labels:** Jenkins, Instance  
+
+Verify there are no inactive users.
+
+:::note 
+This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: jenkins/instance/inactive-users@v2
+with:
+  inactive_for_days: 90
+```
+
+## Mitigation  
+Ensure that no Jenkins instance users are inactive to prevent service disruption.
+
+
+## Description  
+This rule ensures that no Jenkins instance users are inactive.
+It performs the following steps:
+
+1. Checks the settings of the Jenkins instance.
+2. Verifies that no users are inactive.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins instance resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=instance<br/>- platform=jenkins |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| inactive_for_days | number | False | Number of days before a user is considered inactive. |
+
diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md
new file mode 100644
index 000000000..f0a2f2b83
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md
@@ -0,0 +1,51 @@
+---
+sidebar_label: Disallow Unused Users
+title: Disallow Unused Users
+---  
+# Disallow Unused Users  
+**Type:** Rule  
+**ID:** `jenkins-unused-users`  
+**Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.yaml)  
+**Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.rego)  
+**Labels:** Jenkins, Instance  
+
+Verify there are no users with zero activity.
+
+:::note 
+This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: jenkins/instance/unused-users@v2
+```
+
+## Mitigation  
+Ensure that there are no users with zero activity in the Jenkins instance to prevent service disruption.
+
+
+## Description  
+This rule ensures that there are no users with zero activity in the Jenkins instance.
+It performs the following steps:
+
+1. Checks the settings of the Jenkins instance.
+2. Verifies that there are no users with zero activity.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins instance resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=instance<br/>- platform=jenkins |
+
diff --git a/docs/configuration/initiatives/rules/k8s/_category_.json b/docs/configuration/initiatives/rules/k8s/_category_.json
new file mode 100644
index 000000000..8b1cd3ce2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "K8S",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/_category_.json b/docs/configuration/initiatives/rules/k8s/namespace/_category_.json
new file mode 100644
index 000000000..3ea66151d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Namespace",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md
new file mode 100644
index 000000000..03666cf9b
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Container Images
+title: Allowed Container Images
+---  
+# Allowed Container Images  
+**Type:** Rule  
+**ID:** `k8s-namespace-blocked-images`  
+**Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-images.yaml)  
+**Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/blocked-images.rego)  
+**Labels:** K8s, Namespace  
+
+Verify only container images specified in the Allowed List run within the Kubernetes namespace.
+
+:::note 
+This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/allowed-images@v2
+with:
+  images_to_include:
+    - docker.io/my_org/my_image1
+    - docker.io/my_org/my_image2
+```
+
+## Mitigation  
+Ensures that only approved container images are running within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software.
+
+
+## Description  
+This rule ensures that only container images specified in the allowed list are running within the Kubernetes namespace.
+It performs the following steps:
+
+1. Iterates over the container images running in the namespace.
+2. Checks each image against the allowed list specified in the `with.images_to_include` configuration.
+   - If an image is not in the allowed list, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace<br/>- platform=k8s |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| images_to_include | array | False | List of allowed container images. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md
new file mode 100644
index 000000000..269762b58
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Namespace Registries
+title: Allowed Namespace Registries
+---  
+# Allowed Namespace Registries  
+**Type:** Rule  
+**ID:** `k8s-namespace-allowed-registries`  
+**Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.yaml)  
+**Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.rego)  
+**Labels:** K8s, Namespace  
+
+Verify container images in Kubernetes namespaces originate from registries in the Allowed List.
+
+:::note 
+This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/allowed-registries@v2
+with:
+  allowed_registries:
+    - docker.io/*
+    - gcr.io/*
+```
+
+## Mitigation  
+Ensures that only approved container registries are used within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software.
+
+
+## Description  
+This rule ensures that only container images from specified registries are allowed within the Kubernetes namespace.
+It performs the following steps:
+
+1. Iterates over the container images running in the namespace.
+2. Checks each image's registry against the allowed registries specified in the `with.allowed_registries` configuration.
+   - If an image's registry is not in the allowed list, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace<br/>- platform=k8s |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_registries | array | False | A list of allowed container registries Regex patterns. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md
new file mode 100644
index 000000000..756b9a969
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify Namespace Runtime Duration
+title: Verify Namespace Runtime Duration
+---  
+# Verify Namespace Runtime Duration  
+**Type:** Rule  
+**ID:** `k8s-namespace-verify-namespace-duration`  
+**Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.yaml)  
+**Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.rego)  
+**Labels:** K8s, Namespace  
+
+Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits.
+
+:::note 
+This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/verify-namespace-duration@v2
+with:
+  threshold_date: "1970-01-01T00:00:00Z"
+```
+
+## Mitigation  
+Ensures that namespaces do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency.
+
+
+## Description  
+This rule verifies that the duration of namespaces in Kubernetes does not exceed the specified limit.
+It performs the following steps:
+
+1. Iterates over the namespaces in the cluster.
+2. Checks each namespace's duration against the limit specified in the `with.threshold_date` configuration.
+   - If a namespace's duration exceeds the limit, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace<br/>- platform=k8s |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| threshold_date | string | False | The threshold date for namespace duration (supports regex). |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md
new file mode 100644
index 000000000..05dd98d41
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify Namespace Termination
+title: Verify Namespace Termination
+---  
+# Verify Namespace Termination  
+**Type:** Rule  
+**ID:** `k8s-namespace-verify-namespace-termination`  
+**Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.yaml)  
+**Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.rego)  
+**Labels:** K8s, Namespace  
+
+Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene.
+
+:::note 
+This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/verify-namespace-termination@v2
+with:
+  namespaces:
+    - ".*"
+```
+
+## Mitigation  
+Ensures that namespaces are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene.
+
+
+## Description  
+This rule verifies that namespaces in Kubernetes are terminated properly within the specified time frame.
+It performs the following steps:
+
+1. Iterates over the namespaces marked for termination in the cluster.
+2. Checks each namespace's termination time against the limit specified in the `with.max_termination_time` configuration.
+   - If a namespace's termination time exceeds the limit, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace<br/>- platform=k8s |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| namespaces | array | False | A list of namespaces to verify (supports regex). |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md
new file mode 100644
index 000000000..28e6477ab
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Namespaces
+title: Allowed Namespaces
+---  
+# Allowed Namespaces  
+**Type:** Rule  
+**ID:** `k8s-namespace-white-listed-namespaces`  
+**Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.yaml)  
+**Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.rego)  
+**Labels:** K8s, Namespace  
+
+Verify only namespaces specified in the Allowed List are allowed within the cluster.
+
+:::note 
+This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/white-listed-namespaces@v2
+with:
+  namespaces:
+    - default
+```
+
+## Mitigation  
+Ensures that only approved namespaces are allowed within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured namespaces.
+
+
+## Description  
+This rule ensures that only namespaces specified in the whitelist are allowed within the Kubernetes cluster.
+It performs the following steps:
+
+1. Iterates over the namespaces in the cluster.
+2. Checks each namespace against the whitelist specified in the `with.namespaces` configuration.
+   - If a namespace is not in the whitelist, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace<br/>- platform=k8s |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| namespaces | array | False | A list of allowed namespaces. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md
new file mode 100644
index 000000000..e11294ade
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md
@@ -0,0 +1,65 @@
+---
+sidebar_label: Allowed Pods in Namespace
+title: Allowed Pods in Namespace
+---  
+# Allowed Pods in Namespace  
+**Type:** Rule  
+**ID:** `k8s-namespace-white-listed-pod`  
+**Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.yaml)  
+**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.rego)  
+**Labels:** K8s, Namespace  
+
+Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace.
+
+:::note 
+This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/white-listed-pod@v2
+with:
+  white_listed_pod:
+    - my-pod-1.*
+    - my-pod-2.*
+  verify_namespaces:
+    - ",*"
+```
+
+## Mitigation  
+Ensures that only approved pods are running within the Kubernetes namespace, reducing the risk of unauthorized or misconfigured pods.
+
+
+## Description  
+This rule ensures that only pods specified in the whitelist are allowed within the Kubernetes namespace.
+It performs the following steps:
+
+1. Iterates over the pods in the namespace.
+2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration.
+   - If a pod is not in the whitelist, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace<br/>- platform=k8s |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| white_listed_pod | array | True | A list of allowed pods (supports regex). |
+| verify_namespaces | array | False | A list of namespaces to verify. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/pods/_category_.json b/docs/configuration/initiatives/rules/k8s/pods/_category_.json
new file mode 100644
index 000000000..d22e47cb4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/pods/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Pods",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md
new file mode 100644
index 000000000..408898d9b
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify Pod Runtime Duration
+title: Verify Pod Runtime Duration
+---  
+# Verify Pod Runtime Duration  
+**Type:** Rule  
+**ID:** `k8s-pods-verify-pod-duration`  
+**Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.yaml)  
+**Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.rego)  
+**Labels:** K8s, Pod  
+
+Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits.
+
+:::note 
+This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/pods/verify-pod-duration@v2
+with:
+  max_days: 30
+```
+
+## Mitigation  
+Ensures that pods do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency.
+
+
+## Description  
+This rule verifies that the duration of pods in Kubernetes does not exceed the specified limit.
+It performs the following steps:
+
+1. Iterates over the pods in the cluster.
+2. Checks each pod's duration against the limit specified in the `with.max_days` configuration.
+   - If a pod's duration exceeds the limit, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pod<br/>- platform=k8s |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | integer | False | The maximum allowed duration for pods in days. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md
new file mode 100644
index 000000000..c80478ad2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Pod Termination
+title: Verify Pod Termination
+---  
+# Verify Pod Termination  
+**Type:** Rule  
+**ID:** `k8s-pods-verify-pod-termination`  
+**Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.yaml)  
+**Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.rego)  
+**Labels:** K8s, Pod  
+
+Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene.
+
+:::note 
+This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/pods/verify-pod-termination@v2
+```
+
+## Mitigation  
+Ensures that pods are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene.
+
+
+## Description  
+This rule verifies that pods in Kubernetes are terminated properly within the specified time frame.
+It performs the following steps:
+
+1. Iterates over the pods marked for termination in the cluster.
+2. Checks each pod's termination status is present, if such a status is present, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pod<br/>- platform=k8s |
+
diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md
new file mode 100644
index 000000000..ea96297a4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md
@@ -0,0 +1,65 @@
+---
+sidebar_label: Allowed Pods
+title: Allowed Pods
+---  
+# Allowed Pods  
+**Type:** Rule  
+**ID:** `k8s-pods-white-listed-pod`  
+**Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.yaml)  
+**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.rego)  
+**Labels:** K8s, Pod  
+
+Verify only pods explicitly listed in the Allowed List are allowed to run.
+
+:::note 
+This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: k8s/pods/white-listed-pod@v2
+with:
+  white_listed_pod:
+    - my-pod-1.*
+    - my-pod-2.*
+  verify_namespaces:
+    - ".*"
+```
+
+## Mitigation  
+Ensures that only approved pods are running within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured pods.
+
+
+## Description  
+This rule ensures that only pods specified in the whitelist are allowed to run within the Kubernetes cluster.
+It performs the following steps:
+
+1. Iterates over the pods in the cluster.
+2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration.
+   - If a pod is not in the whitelist, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pod<br/>- platform=k8s |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| white_listed_pod | array | True | A list of allowed pods (supports regex). |
+| verify_namespaces | array | True | A list of namespaces to verify (supports regex). |
+
diff --git a/docs/configuration/initiatives/rules/multievidence/_category_.json b/docs/configuration/initiatives/rules/multievidence/_category_.json
new file mode 100644
index 000000000..9696ec52e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/multievidence/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Multievidence",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md
new file mode 100644
index 000000000..d059f7018
--- /dev/null
+++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify File Integrity
+title: Verify File Integrity
+---  
+# Verify File Integrity  
+**Type:** Rule  
+**ID:** `file-integrity`  
+**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml)  
+**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego)  
+**Labels:** SBOM  
+
+Verify the checksum of each file in one SBOM matches the checksum in a second SBOM.
+
+:::note 
+This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS** required by default.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: multievidence/files_integrity@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | True |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| labels | - new_evidence |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| ref_sbom | `{{ .Env.REF_SBOM_DATA }}` |
+| path_prefix | pkg:file/ |
+
diff --git a/docs/configuration/initiatives/rules/sarif/_category_.json b/docs/configuration/initiatives/rules/sarif/_category_.json
new file mode 100644
index 000000000..1d0527158
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "SARIF",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md
new file mode 100644
index 000000000..505777953
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify Artifact Signature in SARIF
+title: Verify Artifact Signature in SARIF
+---  
+# Verify Artifact Signature in SARIF  
+**Type:** Rule  
+**ID:** `sarif-artifact-signed`  
+**Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.yaml)  
+**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.rego)  
+**Labels:** SARIF  
+
+Verify the artifact referenced in the SARIF report is signed to confirm its integrity.
+
+:::note 
+This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS** required by default.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sarif/artifact-signed@v2
+```
+
+## Mitigation  
+Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source.
+
+
+## Description  
+This rule verifies that the artifact referenced in the SARIF report has been cryptographically signed.
+It uses the provided evidence (which must adhere to the SARIF 2.1.0 schema) to confirm that a valid signature exists.
+The rule checks that the evidence indicates the artifact is signed, ensuring that it has not been modified since its creation.
+Additionally, the rule validates that the signature corresponds to one of the expected identities as defined in the configuration.
+
+### **Evidence Requirements**
+- Evidence must be provided in a generic format conforming to SARIF 2.1.0.
+- The SARIF report must indicate that the artifact is signed (i.e., the 'signed' flag is true).
+- The signer's identity should match one of the specified common names or emails in the configuration.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | True |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| identity | `{'common-names': [], 'emails': []}` |
+
diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md
new file mode 100644
index 000000000..79bc0d653
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md
@@ -0,0 +1,44 @@
+---
+sidebar_label: Verify Required Evidence in SARIF
+title: Verify Required Evidence in SARIF
+---  
+# Verify Required Evidence in SARIF  
+**Type:** Rule  
+**ID:** `required-sarif-evidence`  
+**Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.yaml)  
+**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.rego)  
+**Labels:** SARIF  
+
+Verify all required evidence exists as defined by the SARIF policy.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sarif/evidence-exists@v2
+```
+
+## Mitigation  
+By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans  (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence.
+
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/_category_.json b/docs/configuration/initiatives/rules/sarif/patcheck/_category_.json
new file mode 100644
index 000000000..4a0cbea05
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/patcheck/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Patcheck",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md
new file mode 100644
index 000000000..33cf6453f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: SARIF Update Needed
+title: SARIF Update Needed
+---  
+# SARIF Update Needed  
+**Type:** Rule  
+**ID:** `sarif-update-needed`  
+**Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.yaml)  
+**Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.rego)  
+**Labels:** SARIF  
+
+Verify no security packages require updates.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sarif/patcheck/updates-needed@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md
new file mode 100644
index 000000000..b8f387131
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify IaC Misconfiguration Threshold in SARIF
+title: Verify IaC Misconfiguration Threshold in SARIF
+---  
+# Verify IaC Misconfiguration Threshold in SARIF  
+**Type:** Rule  
+**ID:** `sarif-iac-findings`  
+**Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.yaml)  
+**Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.rego)  
+**Labels:** SARIF  
+
+Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sarif/report-iac-errors@v2
+with:
+  violations_threshold: 0
+```
+
+## Mitigation  
+Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images  with insecure configuration settings.
+
+
+## Description  
+This rule evaluates the SARIF report generated by the Vulnerability Scanner to detect vulnerabilities that match
+a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving
+the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration.
+If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes
+details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected.
+
+### **Evidence Requirements**
+
+Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vulnerability Scanner.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/_category_.json b/docs/configuration/initiatives/rules/sarif/trivy/_category_.json
new file mode 100644
index 000000000..54def2fba
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "Trivy",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md
new file mode 100644
index 000000000..4ed4c5181
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md
@@ -0,0 +1,67 @@
+---
+sidebar_label: Trivy Blocklist CVE Check
+title: Trivy Blocklist CVE Check
+---  
+# Trivy Blocklist CVE Check  
+**Type:** Rule  
+**ID:** `trivy-blocklist-cve`  
+**Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/blocklist-cve.yaml)  
+**Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../blocklist-report.rego)  
+**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example  
+**Labels:** SARIF, Trivy  
+
+Verify a CVE Blocklist against a SARIF report
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::info  
+Rule is scoped by product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/blocklist-cve@v2
+```
+
+## Mitigation  
+Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline.
+
+
+## Description  
+This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that no vulnerabilities 
+matching a predefined blocklist of CVE identifiers are present beyond the allowed threshold. The evaluation proceeds as follows:
+
+The rule iterates over the vulnerability results in the SARIF report (located under 
+`input.evidence.predicate.content.runs[0].results`), and for each result, retrieves the corresponding rule definition from 
+`input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex. It then checks if the result's 
+ruleId contains any of the CVE identifiers provided in the `with.rule_ids` configuration parameter. If the total number of such 
+findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded with details including 
+the rule ID, severity (extracted from the rule’s properties), and the location where the vulnerability was detected.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by the "Trivy Vulnerability Scanner".
+- Evidence filtering based on the product must be applied as defined in the configuration.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| rule_ids | array | False | List of CVE identifiers to check for in the Trivy SARIF report. |
+| violations_threshold | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md
new file mode 100644
index 000000000..c49159473
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Verify IaC Misconfiguration Threshold in Trivy SARIF
+title: Verify IaC Misconfiguration Threshold in Trivy SARIF
+---  
+# Verify IaC Misconfiguration Threshold in Trivy SARIF  
+**Type:** Rule  
+**ID:** `trivy-iac-findings`  
+**Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml)  
+**Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../report-iac-errors.rego)  
+**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example  
+**Labels:** SARIF, Trivy  
+
+Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::info  
+Rule is scoped by product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/report-trivy-iac-errors@v2
+with:
+  violations_threshold: 0
+```
+
+## Mitigation  
+Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images  with insecure configuration settings.
+
+
+## Description  
+This rule evaluates the SARIF report generated by the Trivy Vulnerability Scanner to detect vulnerabilities that match
+a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving
+the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration.
+If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes
+details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected.
+
+### **Evidence Requirements**
+
+Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Trivy Vulnerability Scanner.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md
new file mode 100644
index 000000000..29eb14011
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md
@@ -0,0 +1,71 @@
+---
+sidebar_label: Trivy Vulnerability Findings Check
+title: Trivy Vulnerability Findings Check
+---  
+# Trivy Vulnerability Findings Check  
+**Type:** Rule  
+**ID:** `trivy-verify-vulnerability-findings`  
+**Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.yaml)  
+**Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.rego)  
+**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example  
+**Labels:** SARIF, Trivy  
+
+Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed
+the defined severity threshold.
+
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::info  
+Rule is scoped by product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/verify-cve-severity@v2
+with:
+  severity_threshold: 0
+```
+
+## Mitigation  
+Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early.
+
+
+## Description  
+This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it 
+complies with a set of predefined rules. The evaluation is based on several configurable parameters:
+
+The rule iterates over the vulnerability results in the SARIF report (provided under 
+`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding 
+rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's 
+ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified 
+threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by the "Trivy Vulnerability Scanner".
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| severity_threshold | integer | True | The maximum severity level allowed for vulnerabilities. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md
new file mode 100644
index 000000000..552bd5dc6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md
@@ -0,0 +1,49 @@
+---
+sidebar_label: Verify Attack Vector Threshold in Trivy SARIF
+title: Verify Attack Vector Threshold in Trivy SARIF
+---  
+# Verify Attack Vector Threshold in Trivy SARIF  
+**Type:** Rule  
+**ID:** `trivy-attack-vectors`  
+**Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml)  
+**Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-attack-vector.rego)  
+**Labels:** SARIF, Trivy  
+
+Verify no attack vector in the Trivy SARIF report exceeds the specified threshold.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::info  
+Rule is scoped by product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/verify-trivy-attack-vector@v2
+with:
+  attack_vectors:
+    - "stack buffer overflow"
+  violations_threshold: 0
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| attack_vectors | array | False | List of attack vectors to check for in the Trivy SARIF report. |
+| violations_threshold | integer | False | The maximum number of allowed attack vector violations in the Trivy SARIF report. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md
new file mode 100644
index 000000000..36cb48bbe
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md
@@ -0,0 +1,69 @@
+---
+sidebar_label: Verify Trivy SARIF Report Compliance
+title: Verify Trivy SARIF Report Compliance
+---  
+# Verify Trivy SARIF Report Compliance  
+**Type:** Rule  
+**ID:** `trivy-report`  
+**Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-report.yaml)  
+**Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-sarif.rego)  
+**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example  
+**Labels:** SARIF, Trivy  
+
+Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::info  
+Rule is scoped by product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/verify-trivy-report@v2
+```
+
+## Mitigation  
+Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early.
+
+
+## Description  
+This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it 
+complies with a set of predefined rules. The evaluation is based on several configurable parameters:
+
+The rule iterates over the vulnerability results in the SARIF report (provided under 
+`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding 
+rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's 
+ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified 
+threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by the "Trivy Vulnerability Scanner".
+- The evidence must include proper filtering based on the product as defined in the configuration.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| rule_level | array | False | List of rule levels to check for in the Trivy SARIF report. |
+| precision | array | False | List of precision levels to check for in the Trivy SARIF report. |
+| rule_ids | array | False | List of rule IDs to check for in the Trivy SARIF report. |
+| ignore | array | False | List of rule IDs to ignore in the Trivy SARIF report. |
+| max_allowed | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md
new file mode 100644
index 000000000..978972a78
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md
@@ -0,0 +1,70 @@
+---
+sidebar_label: Verify Attack Vector Exists in SARIF
+title: Verify Attack Vector Exists in SARIF
+---  
+# Verify Attack Vector Exists in SARIF  
+**Type:** Rule  
+**ID:** `sarif-attack-vectors`  
+**Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.yaml)  
+**Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.rego)  
+**Labels:** SARIF  
+
+Verify required evidence validates attack vectors in the SARIF report.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sarif/verify-attack-vector@v2
+with:
+  attack_vectors:
+    - "stack buffer overflow"
+  violations_threshold: 0
+```
+
+## Mitigation  
+Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present.
+
+
+## Description  
+This rule evaluates the SARIF report produced by the Vulnerability Scanner to verify that vulnerabilities
+associated with specific attack vectors are properly identified. The rule works as follows:
+
+1. It iterates over the vulnerability results in the SARIF report (from `input.evidence.predicate.content.runs[0].results`).
+2. For each result, it retrieves the corresponding rule definition from 
+   `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex.
+3. The rule checks if the rule’s full description contains the phrase "The attack vector is" and whether it 
+   includes any of the attack vectors specified in the configuration (`with.attack_vectors`).
+4. If such a vulnerability is found and the total number of matching findings exceeds the configured threshold 
+   (`with.violations_threshold`), a violation is recorded. The violation includes the rule identifier and the 
+   associated description.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by a tool like the Vulnerability Scanner.
+- The report must include detailed rule definitions and descriptions that mention attack vectors.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| attack_vectors | array | False | List of attack vectors to check for in the SARIF report. |
+| violations_threshold | integer | False | The maximum number of allowed attack vector violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md
new file mode 100644
index 000000000..ba241238f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md
@@ -0,0 +1,68 @@
+---
+sidebar_label: Verify Rule Compliance in SARIF
+title: Verify Rule Compliance in SARIF
+---  
+# Verify Rule Compliance in SARIF  
+**Type:** Rule  
+**ID:** `sarif-policy`  
+**Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.yaml)  
+**Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.rego)  
+**Labels:** SARIF  
+
+Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sarif/verify-sarif@v2
+```
+
+## Mitigation  
+Ensures that the SARIF report adheres to the predefined generic compliance rules by validating  the vulnerability types, severity levels, and total number of findings. This verification helps maintain  a consistent security posture and prevents the use of images with unacceptable
+
+
+## Description  
+This rule evaluates the SARIF report provided as evidence to verify that it meets a set of predefined generic rules.
+It does so by using helper functions from the `data.sarif` module to:
+
+1. Check that the vulnerability results in the report (found under `input.evidence.predicate.content.runs[0].results`)
+   conform to the expected type and severity level as defined by configuration parameters (such as `rule_level`, `precision`, 
+   `rule_ids`, and `ignore`).
+2. Ensure that the total number of reported violations does not exceed the maximum allowed (`with.max_allowed`).
+
+If the number of violations exceeds the threshold, a violation is recorded with details including the rule identifier, 
+severity, and the corresponding location in the artifact.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format that adheres to the SARIF 2.1.0 schema.
+- The SARIF report should include a structured list of vulnerability results, along with rule definitions and descriptions.
+- The evaluation uses the configuration parameters provided in the `with` section to guide the verification process.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| rule_level | array | False | List of rule levels to check for in the SARIF report. |
+| precision | array | False | List of precision levels to check for in the SARIF report. |
+| rule_ids | array | False | List of rule IDs to check for in the SARIF report. |
+| ignore | array | False | List of rule IDs to ignore in the SARIF report. |
+| max_allowed | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md
new file mode 100644
index 000000000..0d1b0cbc2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md
@@ -0,0 +1,66 @@
+---
+sidebar_label: Verify Semgrep Rule in SARIF
+title: Verify Semgrep Rule in SARIF
+---  
+# Verify Semgrep Rule in SARIF  
+**Type:** Rule  
+**ID:** `sarif-semgrep-report`  
+**Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.yaml)  
+**Rego Source:** [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.rego)  
+**Labels:** SARIF, Semgrep  
+
+Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sarif/verify-semgrep-report@v2
+```
+
+## Mitigation  
+Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards.
+
+
+## Description  
+This rule evaluates the SARIF report generated by Semgrep to verify that it complies with a set of predefined compliance rules.
+It iterates over the vulnerability results in the SARIF report (located under 
+`input.evidence.predicate.content.runs[0].results`) and retrieves the corresponding rule definitions 
+from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on each result's ruleIndex.
+
+The rule checks whether the result’s ruleId contains any of the identifiers specified in the configuration (`with.rule_ids`).
+If the total number of matching findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded.
+Each violation includes details such as the rule identifier, the extracted severity, and the location of the finding.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format conforming to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by Semgrep.
+- The report must include detailed rule definitions and descriptions that support matching against the specified blocklist.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| rule_level | array | False | List of rule levels to check for in the SARIF report. |
+| precision | array | False | List of precision levels to check for in the SARIF report. |
+| rule_ids | array | False | List of rule IDs to check for in the SARIF report. |
+| ignore | array | False | List of rule IDs to ignore in the SARIF report. |
+| max_allowed | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md
new file mode 100644
index 000000000..724104947
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md
@@ -0,0 +1,55 @@
+---
+sidebar_label: Verify Tool Evidence in SARIF
+title: Verify Tool Evidence in SARIF
+---  
+# Verify Tool Evidence in SARIF  
+**Type:** Rule  
+**ID:** `sarif-tool-evidence`  
+**Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.yaml)  
+**Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.rego)  
+**Labels:** SARIF  
+
+Verify required tools were used to generate the SARIF report.
+
+:::note 
+This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sarif/verify-tool-evidence@v2
+```
+
+## Mitigation  
+Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy.
+
+
+## Description  
+This rule checks the `tool` field in the SARIF evidence to verify that it matches the expected scanner 
+(e.g., "Semgrep Vulnerability Scanner" or "Trivy Vulnerability Scanner"). Set evidence match criteria: 
+the `tool` field must equal the expected scanner name to ensure the report is generated by the correct tool. 
+A mismatch indicates that the report may not be reliable.
+
+### **Evidence Requirements**
+- Evidence must adhere to the SARIF 2.1.0 schema.
+- The report must include a valid `tool` field.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| tool | semgrep |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md
new file mode 100644
index 000000000..f6d02669a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md
@@ -0,0 +1,84 @@
+---
+sidebar_label: NTIA SBOM Compliance Check
+title: NTIA SBOM Compliance Check
+---  
+# NTIA SBOM Compliance Check  
+**Type:** Rule  
+**ID:** `NTIA-compliance`  
+**Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml)  
+**Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego)  
+**Labels:** SBOM, Compliance, Image, Git  
+
+Validates that SBOM metadata meets basic NTIA requirements for authors and supplier.
+
+:::note 
+This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::note 
+Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements.
+
+For example,  
+```yaml
+valint bom my_company/my_image:latest \
+  --author-name "bob" \
+  --author-email bob@my_company.com \
+  --author-phone "123-456-7890" \
+  --supplier-email bob@my_company.com  \
+  --supplier-name "alice" \
+  --supplier-url "https://my_company.com" \
+  --supplier-phone "123-456-7890" 
+```
+  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/NTIA-compliance@v2
+with:
+  required_author: 
+    name: "bom"
+    email: "bob@company.com"
+  required_supplier: 
+    name: "alice"
+```
+
+## Mitigation  
+Ensures that the SBOM metadata meets NTIA requirements, reducing the risk of incomplete or inaccurate information about authors and suppliers.
+
+
+## Description  
+This rule validates that the SBOM metadata meets basic NTIA requirements for authors and suppliers.
+It performs the following steps:
+
+1. Checks that authors exist, are non-empty, and each author has both a name and email.
+2. Checks that the supplier exists with a non-empty name, URL, and contact. At least one contact must have a non-empty email.
+3. Optionally enforces a required author (case-insensitive match for name/email).
+4. Optionally enforces a required supplier (case-insensitive match for supplier name).
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include metadata for authors and suppliers.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| required_author | object | False | The required author (case-insensitive match for name/email). |
+| required_supplier | object | False | The required supplier (case-insensitive match for supplier name). |
+
diff --git a/docs/configuration/initiatives/rules/sbom/_category_.json b/docs/configuration/initiatives/rules/sbom/_category_.json
new file mode 100644
index 000000000..cdfd70c71
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "SBOM",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md
new file mode 100644
index 000000000..d9a5b8273
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md
@@ -0,0 +1,70 @@
+---
+sidebar_label: Enforce Allowed SBOM Components
+title: Enforce Allowed SBOM Components
+---  
+# Enforce Allowed SBOM Components  
+**Type:** Rule  
+**ID:** `sbom-allowed-components`  
+**Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml)  
+**Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego)  
+**Labels:** SBOM, Image  
+
+Verify the artifact contains only allowed components.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::note 
+Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/allowed-components@v2
+with:
+  types:
+    - library
+    - operating-system
+```
+
+## Mitigation  
+Ensures that only approved components are included in the SBOM, reducing the risk of introducing vulnerabilities or unapproved dependencies into the software supply chain.
+
+
+## Description  
+This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it contains only allowed components.
+It performs the following steps:
+
+1. Iterates over the components listed in the SBOM.
+2. Checks each component's type against the allowed types specified in the `with.types` configuration.
+3. Compares each component's name against the allowlist provided in the `with.allowlist` configuration.
+   - If a component's type or name is not allowed, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of components with their types and names.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| types | array | True | A list of allowed component types. |
+| allowlist | array | True | A list of allowed components. |
+
diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md
new file mode 100644
index 000000000..06d7cbc77
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: Require SBOM Signature
+title: Require SBOM Signature
+---  
+# Require SBOM Signature  
+**Type:** Rule  
+**ID:** `sbom-signed`  
+**Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml)  
+**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego)  
+**Labels:** SBOM, Blueprint  
+
+Verify the SBOM is signed.
+
+:::note 
+This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS** required by default.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/artifact-signed@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| content_body_type | cyclonedx-json |
+| signed | True |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| identity | `{'common-names': [], 'emails': []}` |
+
diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md
new file mode 100644
index 000000000..98bc2c6b0
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md
@@ -0,0 +1,68 @@
+---
+sidebar_label: Restrict Disallowed SBOM Licenses
+title: Restrict Disallowed SBOM Licenses
+---  
+# Restrict Disallowed SBOM Licenses  
+**Type:** Rule  
+**ID:** `sbom-disallowed-licenses`  
+**Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml)  
+**Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego)  
+**Labels:** SBOM, Image  
+
+Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/banned-licenses@v2
+with:
+  blocklist:
+    - "GPL-2.0"
+    - "GPL-3.0"
+  blocklisted_limit: 1
+```
+
+## Mitigation  
+Ensures that the software components used in the artifact comply with organizational policies by restricting the use of disallowed licenses. This helps prevent legal and compliance issues that may arise from using components with incompatible or risky licenses.
+
+
+## Description  
+This rule inspects the CycloneDX SBOM evidence for the artifact to verify that the number of components with disallowed licenses
+remains below the specified threshold. It performs the following steps:
+
+1. Iterates over the components listed in the SBOM.
+2. Checks each component's license against the blocklist provided in the `with.blocklist` configuration.
+3. Counts the number of components with disallowed licenses.
+   - If the count exceeds the specified `with.blocklisted_limit`, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of components with their licenses.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| blocklist | array | False | A list of disallowed licenses. |
+| blocklisted_limit | integer | False | The maximum number of components with disallowed licenses allowed. |
+
diff --git a/docs/configuration/initiatives/rules/sbom/banned-users.md b/docs/configuration/initiatives/rules/sbom/banned-users.md
new file mode 100644
index 000000000..b7728c0e2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/banned-users.md
@@ -0,0 +1,41 @@
+---
+sidebar_label: Disallow Specific Users in SBOM
+title: Disallow Specific Users in SBOM
+---  
+# Disallow Specific Users in SBOM  
+**Type:** Rule  
+**ID:** `sbom-disallowed-users`  
+**Source:** [v2/rules/sbom/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-users.yaml)  
+**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-users.rego)  
+**Labels:** SBOM, Image  
+
+Verify specific users are not allowed in an SBOM.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: sbom/banned-users@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| users | ['root'] |
+
diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md
new file mode 100644
index 000000000..060c6f0db
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md
@@ -0,0 +1,46 @@
+---
+sidebar_label: Restrict Disallowed Dependencies
+title: Restrict Disallowed Dependencies
+---  
+# Restrict Disallowed Dependencies  
+**Type:** Rule  
+**ID:** `sbom-disallow-dependencies`  
+**Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml)  
+**Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego)  
+**Labels:** SBOM, Image, Blueprint  
+
+Verify the number of disallowed dependencies remains below the specified threshold.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/blocklist-packages@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| blocklist | [] |
+| blocklisted_limit | 0 |
+
diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md
new file mode 100644
index 000000000..e345155b5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md
@@ -0,0 +1,56 @@
+---
+sidebar_label: Enforce SBOM License Completeness
+title: Enforce SBOM License Completeness
+---  
+# Enforce SBOM License Completeness  
+**Type:** Rule  
+**ID:** `sbom-require-complete-license-set`  
+**Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml)  
+**Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego)  
+**Labels:** SBOM, Image  
+
+Verify all dependencies in the artifact have a license.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/complete-licenses@v2
+```
+
+## Mitigation  
+Ensures that all dependencies have a complete set of licenses, reducing the risk of legal issues and ensuring compliance with open-source licenses.
+
+
+## Description  
+This rule inspects the CycloneDX SBOM evidence for the artifact to verify that all dependencies have a complete set of licenses.
+It performs the following steps:
+
+1. Iterates over the dependencies listed in the SBOM.
+2. Checks each dependency for the presence of a license.
+   - If a dependency does not have a license, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of dependencies with their licenses.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
diff --git a/docs/configuration/initiatives/rules/sbom/evidence-exists.md b/docs/configuration/initiatives/rules/sbom/evidence-exists.md
new file mode 100644
index 000000000..e84b7b34d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/evidence-exists.md
@@ -0,0 +1,42 @@
+---
+sidebar_label: Require SBOM Existence
+title: Require SBOM Existence
+---  
+# Require SBOM Existence  
+**Type:** Rule  
+**ID:** `require-sbom`  
+**Source:** [v2/rules/sbom/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/evidence-exists.yaml)  
+**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/evidence-exists.rego)  
+**Labels:** SBOM, Blueprint  
+
+Verify the SBOM exists as evidence.
+
+:::note 
+This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/evidence-exists@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| content_body_type | cyclonedx-json |
+| signed | False |
+
diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md
new file mode 100644
index 000000000..cb28f20b2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Enforce SBOM Freshness
+title: Enforce SBOM Freshness
+---  
+# Enforce SBOM Freshness  
+**Type:** Rule  
+**ID:** `fresh-sbom`  
+**Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml)  
+**Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego)  
+**Labels:** SBOM  
+
+Verify the SBOM is not older than the specified duration.
+
+:::note 
+This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/fresh-sbom@v2
+with:
+  max_days: 30
+```
+
+## Mitigation  
+Ensures that the SBOM is up-to-date, reducing the risk of outdated information and ensuring accurate tracking of components.
+
+
+## Description  
+This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it is not older than the specified duration.
+It performs the following steps:
+
+1. Checks the creation date of the SBOM.
+2. Compares the creation date against the maximum allowed age specified in the `with.max_days` configuration.
+   - If the SBOM is older than the allowed duration, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a creation date.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | integer | False | The maximum allowed age of the SBOM in days. |
+
diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md
new file mode 100644
index 000000000..6912a8916
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md
@@ -0,0 +1,56 @@
+---
+sidebar_label: Require SBOM Existence
+title: Require SBOM Existence
+---  
+# Require SBOM Existence  
+**Type:** Rule  
+**ID:** `require-sbom`  
+**Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml)  
+**Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego)  
+**Labels:** SBOM, Blueprint, Image, Git  
+
+Verify the SBOM exists as evidence.
+
+:::note 
+This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/require-sbom@v2
+```
+
+## Mitigation  
+Ensures that an SBOM is present, which is essential for tracking and managing software components and their dependencies.
+
+
+## Description  
+This rule verifies the existence of an SBOM as evidence.
+It performs the following steps:
+
+1. Checks for the presence of an SBOM.
+   - If the SBOM is missing, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| content_body_type | cyclonedx-json |
+| signed | False |
+
diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md
new file mode 100644
index 000000000..934e64052
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/required-packages.md
@@ -0,0 +1,67 @@
+---
+sidebar_label: Enforce SBOM Dependencies
+title: Enforce SBOM Dependencies
+---  
+# Enforce SBOM Dependencies  
+**Type:** Rule  
+**ID:** `sbom-required-dependencies`  
+**Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.yaml)  
+**Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego)  
+**Labels:** SBOM, Image  
+
+Verify the artifact includes all required dependencies.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/required-packages@v2
+with:
+  required_pkgs:
+    - "pkg:maven/org.apache.commons/commons-lang3@3.9"
+    - "pkg:npm/lodash@4.17.15"
+  violations_limit: 0
+```
+
+## Mitigation  
+Ensures that all required dependencies are included in the SBOM, reducing the risk of missing critical components and ensuring compliance with dependency requirements.
+
+
+## Description  
+This rule verifies that the artifact includes all required dependencies as specified.
+It performs the following steps:
+
+1. Iterates over the dependencies listed in the SBOM.
+2. Checks each dependency against the required dependencies specified in the `with.required_pkgs` configuration.
+   - If a required dependency is missing, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of dependencies.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| required_pkgs | array | True | A list of required dependencies specified as PURLs. |
+| violations_limit | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md
new file mode 100644
index 000000000..b7edfa1a5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md
@@ -0,0 +1,69 @@
+---
+sidebar_label: Require Specified SBOM Licenses
+title: Require Specified SBOM Licenses
+---  
+# Require Specified SBOM Licenses  
+**Type:** Rule  
+**ID:** `sbom-hf-license`  
+**Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml)  
+**Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego)  
+**Labels:** SBOM, Image  
+
+Verify the artifact includes all specified licenses.
+
+:::note 
+This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details.  
+::: 
+:::note 
+Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: sbom/verify-huggingface-license@v2
+with:
+  licenses:
+    - "MIT"
+    - "Apache-2.0"
+```
+
+## Mitigation  
+Ensures that all specified licenses are included in the SBOM, reducing the risk of legal issues and ensuring compliance with open-source licenses.
+
+
+## Description  
+This rule verifies that the artifact includes all specified licenses.
+It performs the following steps:
+
+1. Iterates over the dependencies listed in the SBOM.
+2. Checks each dependency for the presence of the specified licenses in the `with.licenses` configuration.
+   - If a specified license is missing, the rule flags it as a violation.
+3. Accesses the Hugging Face API to validate the licenses.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of dependencies with their licenses.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| licenses | array | True | A list of specified licenses. |
+
diff --git a/docs/configuration/initiatives/rules/slsa/_category_.json b/docs/configuration/initiatives/rules/slsa/_category_.json
new file mode 100644
index 000000000..da652e8f6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "SLSA",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md
new file mode 100644
index 000000000..5a1ce8f08
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md
@@ -0,0 +1,41 @@
+---
+sidebar_label: Disallow dependencies in SLSA Provenance Document
+title: Disallow dependencies in SLSA Provenance Document
+---  
+# Disallow dependencies in SLSA Provenance Document  
+**Type:** Rule  
+**ID:** `slsa-builder-unallowed-dependencies`  
+**Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.yaml)  
+**Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.rego)  
+**Labels:** SLSA, Image  
+
+Verify that dependencies in the block list do not appear in the SLSA Proveance document.
+
+:::note 
+This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: slsa/banned-builder-deps@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| blocklist | [] |
+
diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md
new file mode 100644
index 000000000..3544a7642
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/build-time.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify build time
+title: Verify build time
+---  
+# Verify build time  
+**Type:** Rule  
+**ID:** `slsa-build-time`  
+**Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.yaml)  
+**Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.rego)  
+**Labels:** SLSA, Image  
+
+Verify the artifact was created within the specified time window.
+
+:::note 
+This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: slsa/build-time@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| start_hour | 8 |
+| end_hour | 20 |
+| workdays | ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday'] |
+
diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md
new file mode 100644
index 000000000..0895f0509
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/field-exists.md
@@ -0,0 +1,42 @@
+---
+sidebar_label: SLSA Field Exists in Provenance Document
+title: SLSA Field Exists in Provenance Document
+---  
+# SLSA Field Exists in Provenance Document  
+**Type:** Rule  
+**ID:** `slsa-field-exists`  
+**Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.yaml)  
+**Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.rego)  
+**Labels:** SLSA, Image  
+
+Verify the specified field exists in the provenance document.
+
+:::note 
+This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: slsa/field-exists@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| paths | [] |
+| violations_threshold | 0 |
+
diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md
new file mode 100644
index 000000000..74d5688c9
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: Verify Provenance Document Exists
+title: Verify Provenance Document Exists
+---  
+# Verify Provenance Document Exists  
+**Type:** Rule  
+**ID:** `SLSA.L1`  
+**Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.yaml)  
+**Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.rego)  
+**Help:** https://slsa.dev/spec/v1.0/requirements  
+**Labels:** SLSA  
+
+Verify that the Provenance document evidence exists.
+
+:::note 
+This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: slsa/l1-provenance-exists@v2
+```
+
+## Mitigation  
+Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed.
+
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | slsa |
+
diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md
new file mode 100644
index 000000000..7dd18db29
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify that provenance is authenticated
+title: Verify that provenance is authenticated
+---  
+# Verify that provenance is authenticated  
+**Type:** Rule  
+**ID:** `SLSA.L2`  
+**Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.yaml)  
+**Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.rego)  
+**Help:** https://slsa.dev/spec/v1.0/requirements  
+**Labels:** SLSA  
+
+Verify the artifact is signed.
+
+:::note 
+This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details.  
+::: 
+:::tip 
+> Evidence **IS** required for this rule and will fail if missing.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS** required by default.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: slsa/l2-provenance-authenticated@v2
+```
+
+## Mitigation  
+Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain.
+
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | True |
+| content_body_type | slsa |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| identity | `{'common-names': [], 'emails': []}` |
+
diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md
new file mode 100644
index 000000000..2bc163454
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md
@@ -0,0 +1,42 @@
+---
+sidebar_label: Verify that artifact was created by the specified builder
+title: Verify that artifact was created by the specified builder
+---  
+# Verify that artifact was created by the specified builder  
+**Type:** Rule  
+**ID:** `slsa-verify-builder`  
+**Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.yaml)  
+**Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.rego)  
+**Labels:** SLSA, Image  
+
+Verify the artifact was created by the specified builder.
+
+:::note 
+This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::info  
+Rule is scoped by pipeline and product.  
+:::  
+
+## Usage example
+
+```yaml
+uses: slsa/verify-builder@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['pipeline', 'product'] |
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| id | `{{ .Env.HOSTNAME }}` |
+
diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md
new file mode 100644
index 000000000..7477a84e8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md
@@ -0,0 +1,41 @@
+---
+sidebar_label: Verify that artifact has no disallowed builder dependencies
+title: Verify that artifact has no disallowed builder dependencies
+---  
+# Verify that artifact has no disallowed builder dependencies  
+**Type:** Rule  
+**ID:** `slsa-verify-byproducts`  
+**Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.yaml)  
+**Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.rego)  
+**Labels:** SLSA, Image  
+
+Verify the artifact has no disallowed builder dependencies.
+
+:::note 
+This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: slsa/verify-byproducts@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| byproducts | [] |
+
diff --git a/docs/configuration/initiatives/rules/ssdf/_category_.json b/docs/configuration/initiatives/rules/ssdf/_category_.json
new file mode 100644
index 000000000..dc1b66dcb
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/_category_.json
@@ -0,0 +1,4 @@
+{
+  "label": "SSDF",
+  "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md
new file mode 100644
index 000000000..7f44e5053
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md
@@ -0,0 +1,33 @@
+---
+sidebar_label: Enforce 2FA
+title: Enforce 2FA
+---  
+# Enforce 2FA  
+**Type:** Rule  
+**ID:** `PS.1.1`  
+**Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-2fa.yaml)  
+**Labels:** SSDF  
+
+PS.1 Require 2FA for accessing code
+
+:::note 
+This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: ssdf/ps-1-2fa@v2
+```
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md
new file mode 100644
index 000000000..da0522bd1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: Branch protected
+title: Branch protected
+---  
+# Branch protected  
+**Type:** Rule  
+**ID:** `PS.1.2`  
+**Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-branch-protection.yaml)  
+**Labels:** SSDF  
+
+PS.1 Require branch protection for the repository
+
+:::note 
+This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: ssdf/ps-1-branch-protection@v2
+```
+
+## Mitigation  
+Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches.
+
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_protected | True |
+
diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md
new file mode 100644
index 000000000..59871259d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: Limit admins
+title: Limit admins
+---  
+# Limit admins  
+**Type:** Rule  
+**ID:** `PS.1.3`  
+**Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-limit-admins.yaml)  
+**Labels:** SSDF  
+
+PS.1 Restrict the maximum number of organization admins
+
+:::note 
+This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: ssdf/ps-1-limit-admins@v2
+```
+
+## Mitigation  
+Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges.
+
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| max_admins | 3 |
+
diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md
new file mode 100644
index 000000000..16ff0d8de
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: Repo private
+title: Repo private
+---  
+# Repo private  
+**Type:** Rule  
+**ID:** `PS.1.4`  
+**Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-repo-private.yaml)  
+**Labels:** SSDF  
+
+PS.1 Assure the repository is private
+
+:::note 
+This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: ssdf/ps-1-repo-private@v2
+```
+
+## Mitigation  
+Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties.
+
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md
new file mode 100644
index 000000000..af3734b98
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: Require signoff on web commits
+title: Require signoff on web commits
+---  
+# Require signoff on web commits  
+**Type:** Rule  
+**ID:** `PS.1.5`  
+**Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-web-commit-signoff.yaml)  
+**Labels:** SSDF  
+
+PS.1 Require contributors to sign when committing to Github through the web interface
+
+:::note 
+This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: ssdf/ps-1-web-commit-signoff@v2
+```
+
+## Mitigation  
+Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications.
+
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md
new file mode 100644
index 000000000..6bd9ea030
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: Image-verifiable
+title: Image-verifiable
+---  
+# Image-verifiable  
+**Type:** Rule  
+**ID:** `PS.2`  
+**Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-2-image-verifiable.yaml)  
+**Labels:** SSDF  
+
+PS.2 Provide a mechanism to verify the integrity of the image
+
+:::note 
+This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: ssdf/ps-2-image-verifiable@v2
+```
+
+## Mitigation  
+Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity.
+
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| target_type | container |
+
diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md
new file mode 100644
index 000000000..e86b3f56a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md
@@ -0,0 +1,40 @@
+---
+sidebar_label: Code archived
+title: Code archived
+---  
+# Code archived  
+**Type:** Rule  
+**ID:** `PS.3.1`  
+**Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.1-code-archived.yaml)  
+**Labels:** SSDF  
+
+PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository
+
+:::note 
+This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: ssdf/ps-3.1-code-archived@v2
+```
+
+## Mitigation  
+Archives code changes to maintain a secure, immutable history for auditing and traceability.
+
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| allow | True |
+| short_description | Code is archived. |
+| description | Since the code is within a repository, it is archived. |
+| reason | The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository. |
+
diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md
new file mode 100644
index 000000000..320c41aab
--- /dev/null
+++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md
@@ -0,0 +1,32 @@
+---
+sidebar_label: SBOM archived
+title: SBOM archived
+---  
+# SBOM archived  
+**Type:** Rule  
+**ID:** `PS.3.2`  
+**Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.2-archived-sbom.yaml)  
+**Labels:** SSDF  
+
+PS.3.2 Archive SBOM
+
+:::note 
+This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: ssdf/ps-3.2-archived-sbom@v2
+```
+
+## Mitigation  
+Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks.
+
+
diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md
new file mode 100644
index 000000000..3957036d0
--- /dev/null
+++ b/docs/configuration/initiatives/slsa.l1.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: SLSA L1 Framework
+title: SLSA L1 Framework
+---  
+# SLSA L1 Framework  
+**Type:** Initiative  
+**ID:** `SLSA.L1`  
+**Version:** `1.0.0`  
+**Bundle-Version:** `v2`  
+**Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml)  
+**Help:** https://slsa.dev/  
+
+Evaluate SLSA Level 1
+
+## **Description**
+
+This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[prov_exists] Provenance exists](#prov_exists-provenance-exists) | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [prov_exists] Provenance exists
+
+This control verifies that essential provenance metadata is present for each build artifact.
+
+
+### Mitigation  
+Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. |
diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md
new file mode 100644
index 000000000..ee0f9965e
--- /dev/null
+++ b/docs/configuration/initiatives/slsa.l2.md
@@ -0,0 +1,48 @@
+---
+sidebar_label: SLSA L2 Framework
+title: SLSA L2 Framework
+---  
+# SLSA L2 Framework  
+**Type:** Initiative  
+**ID:** `SLSA.L2`  
+**Version:** `1.0.0`  
+**Bundle-Version:** `v2`  
+**Source:** [v2/initiatives/slsa.l2.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml)  
+**Help:** https://slsa.dev/  
+
+Evaluate SLSA Level 2
+
+## **Description**
+
+Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity."
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[prov_authn] Provenance authenticated](#prov_authn-provenance-authenticated) | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [prov_authn] Provenance authenticated
+
+Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source.
+
+
+### Mitigation  
+Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. |
+| [prov_authn](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. |
diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md
new file mode 100644
index 000000000..c5423f3b8
--- /dev/null
+++ b/docs/configuration/initiatives/sp-800-190.md
@@ -0,0 +1,68 @@
+---
+sidebar_label: NIST Application Container Security Initiative
+title: NIST Application Container Security Initiative
+---  
+# NIST Application Container Security Initiative  
+**Type:** Initiative  
+**ID:** `SP-800-190`  
+**Version:** `1.0.0`  
+**Bundle-Version:** `v2`  
+**Source:** [v2/initiatives/sp-800-190.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-190.yaml)  
+**Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final  
+
+This initiative enforces container security controls as outlined in  NIST SP 800-190. It ensures that containerized applications follow  security best practices, including vulnerability scanning, trusted  image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls  throughout the software development lifecycle (SDLC), providing real-time  feedback to developers and enforcement in CI/CD pipelines.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[4.1]  IMAGE COUNTERMEASURES](#41-41-image-countermeasures) | Implements security controls to reduce risks associated with  container images, such as vulnerabilities, misconfigurations,  and unauthorized images. The policies enforce CVE scanning,  mandatory security settings, and allow only trusted sources. | Ensures that all container images meet organizational security  policies before deployment. Helps reduce the attack surface by  blocking images with vulnerabilities, misconfigurations, or  unauthorized sources. |
+| [[4.2]  REGISTRY COUNTERMEASURES](#42-42-registry-countermeasures) | Implements controls to secure container image registries by enforcing  HTTPS connections, verifying image freshness, and preventing stale  images from being used. | Reduces risks associated with registry security, stale images,  and unauthorized image pulls. Ensures that images are kept up-to-date  and only retrieved from secure sources. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [4.1] 4.1 IMAGE COUNTERMEASURES
+
+Implements security controls to reduce risks associated with  container images, such as vulnerabilities, misconfigurations,  and unauthorized images. The policies enforce CVE scanning,  mandatory security settings, and allow only trusted sources.
+
+
+### Mitigation  
+Ensures that all container images meet organizational security  policies before deployment. Helps reduce the attack surface by  blocking images with vulnerabilities, misconfigurations, or  unauthorized sources.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [trivy-verify-vulnerability-findings](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. |
+| [trivy-blocklist-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are  actively exploited or widely known. |
+| [sbom-disallowed-users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. |
+| [images-banned-ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be  used in containerized applications. |
+| [images-require-healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction  to monitor their runtime health. |
+| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as  creation time, version, and source repository. |
+| [images-allowed-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. |
+| [images-allowed-image-source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. |
+| [images-require-signed-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. |
+
+## [4.2] 4.2 REGISTRY COUNTERMEASURES
+
+Implements controls to secure container image registries by enforcing  HTTPS connections, verifying image freshness, and preventing stale  images from being used.
+
+
+### Mitigation  
+Reduces risks associated with registry security, stale images,  and unauthorized image pulls. Ensures that images are kept up-to-date  and only retrieved from secure sources.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [images-registry-https-check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. |
+| [images-fresh-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. |
+| [fresh-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. |
diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md
new file mode 100644
index 000000000..90e6cddec
--- /dev/null
+++ b/docs/configuration/initiatives/sp-800-53.md
@@ -0,0 +1,80 @@
+---
+sidebar_label: NIST Supply Chain Integrity Initiative
+title: NIST Supply Chain Integrity Initiative
+---  
+# NIST Supply Chain Integrity Initiative  
+**Type:** Initiative  
+**ID:** `SP-800-53`  
+**Version:** `1.0.0`  
+**Bundle-Version:** `v2`  
+**Source:** [v2/initiatives/sp-800-53.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-53.yaml)  
+**Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final  
+
+This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include:
+  - A Software Bill of Materials (SBOM) to ensure component inventory and traceability,
+    addressing requirements from SR-4 and CM-8.
+  - Provenance data to support architectural traceability, as outlined in SA-8.
+Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[SR4_CM8] SBOM Requirement](#sr4_cm8-sbom-requirement) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. |
+| [[SA8] Provenance Requirement](#sa8-provenance-requirement) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. |
+| [[SA12] SBOM Signature Enforcement](#sa12-sbom-signature-enforcement) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [SR4_CM8] SBOM Requirement
+
+Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8.
+
+
+### Mitigation  
+Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. |
+| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: |
+| [NTIA-compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. |
+
+## [SA8] Provenance Requirement
+
+Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8.
+
+
+### Mitigation  
+Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [SLSA.L1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. |
+
+## [SA12] SBOM Signature Enforcement
+
+Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements.
+
+
+### Mitigation  
+Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. |
+| [SLSA.L2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. |
diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md
new file mode 100644
index 000000000..0507f5824
--- /dev/null
+++ b/docs/configuration/initiatives/ssdf.md
@@ -0,0 +1,82 @@
+---
+sidebar_label: SSDF Client Initiative
+title: SSDF Client Initiative
+---  
+# SSDF Client Initiative  
+**Type:** Initiative  
+**ID:** `SSDF`  
+**Version:** `1.0.0`  
+**Bundle-Version:** `v2`  
+**Source:** [v2/initiatives/ssdf.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/ssdf.yaml)  
+**Help:** https://csrc.nist.gov/pubs/sp/800/218/final  
+
+Evaluate PS rules from the SSDF initiative
+
+## **Description**
+
+This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure  the integrity and security of your software supply chain. It evaluates critical process (PS) rules  to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [SSDF-IMAGE](#ssdf-image) | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules  that verify image build integrity and preserve critical SBOM metadata. |
+| [SSDF-ORG](#ssdf-org) | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices  and process signoffs. |
+| [SSDF-REPO](#ssdf-repo) | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls  and preserving code history. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## SSDF-IMAGE
+
+Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity.
+
+
+### Mitigation  
+Mitigates the risk of deploying untrusted or compromised container images by enforcing rules  that verify image build integrity and preserve critical SBOM metadata.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [PS.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image |
+| [PS.3.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM |
+
+## SSDF-ORG
+
+Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced.
+
+
+### Mitigation  
+Reduces risks of unauthorized access and changes by ensuring strong organizational security practices  and process signoffs.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [PS.1.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code |
+| [PS.1.3](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins |
+| [PS.1.5](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface |
+
+## SSDF-REPO
+
+Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy.
+
+
+### Mitigation  
+Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls  and preserving code history.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [PS.3.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository |
+| [PS.1.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository |
+| [PS.1.4](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private |
diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md
index 44aebcf7f..542c93571 100644
--- a/docs/guides/enforcing-sdlc-initiative.md
+++ b/docs/guides/enforcing-sdlc-initiative.md
@@ -287,42 +287,343 @@ INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary:
 
 In this case, no rule was disabled, and all of them were verified.
 
-## Sample Rule Catalog
+## Sample Policy Catalog
 
-We provide a set of sample rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default.
+We provide a set of sample initiatives and rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default.
 To use a different version of this catalog, use the `--bundle-tag` valint flag.
 
-To use a custom rule catalog, you can specify the path to the catalog in the `--bundle` flag (it may be a local path or a git repo). Additionally, `--bundle-branch` and `--bundle-tag` flags can be used to specify the branch or tag of the catalog git repo.
-
-| Rule | Description | Additional Info |
-| --- | --- | --- |
-| [Require SBOM Signature](#require-sbom-signature) | Verify the SBOM is signed. | [SBOM](#sbom) |
-| [Restrict Disallowed Dependencies](#restrict-disallowed-dependencies) | Verify the number of disallowed dependencies remains below the specified threshold. | [SBOM](#sbom) |
-| [Enforce SBOM Dependencies](#enforce-sbom-dependencies) | Verify the artifact includes all required dependencies. | [SBOM](#sbom) |
-| [Restrict Disallowed SBOM Licenses](#restrict-disallowed-sbom-licenses) | Verify specific users are not allowed in an SBOM. | [SBOM](#sbom) |
-| [Enforce SBOM License Completeness](#enforce-sbom-license-completeness) | Verify all dependencies in the artifact have a license. | [SBOM](#sbom) |
-| [Enforce SBOM Freshness](#enforce-sbom-freshness) | Verify the SBOM is not older than the specified duration. | [SBOM](#sbom) |
-| [Fresh Image](#fresh-image) |Verify the image is not older than the specified threshold. | [Image SBOM](#images) |
-| [Disallow Container Shell Entrypoint](#disallow-container-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](#images) |
-| [Restrict Build Scripts](#restrict-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](#images) |
-| [Verify Image Labels](#verify-image-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](#images)  |
-| [Forbid Large Images](#forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](#images) |
-| [Restrict Coding Permissions](#restrict-coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](#git) |
-| [Disallow Unsigned Commits](#disallow-unsigned-commits) | Verify all commits are signed. | [Git SBOM](#git) |
-| [Disallow Commits to Main Branch](#disallow-commits-to-main-branch) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](#git) |
-| [Verify that artifact was created by the specified builder](#verify-that-artifact-was-created-by-the-specified-builder) | Verify the artifact was created by the specified builder. | [SLSA-Prov](#slsa) |
-| [Disallow dependencies in SLSA Provenance Document](#disallow-dependencies-in-slsa-provenance-document) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA-Prov](#slsa) |
-| [Verify Build Time](#verify-build-time) | Verify the artifact was created within the specified time window. | [SLSA-Prov](#slsa) |
-| [Verify that artifact has no disallowed builder dependencies](#verify-that-artifact-has-no-disallowed-builder-dependencies) | Verify the artifact has no disallowed builder dependencies. | [SLSA-Prov](#slsa) |
-| [SLSA Field Exists in Provenance Document](#slsa-field-exists-in-provenance-document) | Verify the specified field exists in the provenance document. | [SLSA-Prov](#slsa) |
-| [Verify Rule Compliance in SARIF](#verify-rule-compliance-in-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF](#sarif-reports) |
-| [Do Not Allow Vulnerabilities Based On Specific Attack Vector](#do-not-allow-vulnerabilities-based-on-specific-attack-vector) | Restrict vulnerabilities based on specific attack vector. | [SARIF](#sarif-reports) |
-| [Verify IaC Misconfiguration Threshold in SARIF](#verify-iac-misconfiguration-threshold-in-sarif) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF](#sarif-reports) |
-| [Verify Semgrep Rule in SARIF](#verify-semgrep-rule-in-sarif) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF](#sarif-reports) |
-| [Verify Tool Evidence in SARIF](#verify-tool-evidence-in-sarif) | Verify required tools were used to generate the SARIF report. | [SARIF](#sarif-reports) |
-| [K8s Jailbreak](#k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold. | [Generic](#generic) |
-| [Verify Github Branch Protection](https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/api/branch-protection.md) | Verify that the branch protection rules are compliant to required | None |
-| [Verify GitLab Push Rules](https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/gitlab/api/push-rules.md) | Verify that the push rules are compliant to required. GitLabs push rules overlap some of GitHub's branch protection rules | None |
+To use a custom initiatives rule catalog, you can specify the path to the catalog in the `--bundle` flag (it may be a local path or a git repo). Additionally, `--bundle-branch` and `--bundle-tag` flags can be used to specify the branch or tag of the catalog git repo.
+
+<!-- START TABLE -->
+| Name | Description |
+|------|-------------|
+| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab |
+| [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 |
+| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include:   - A Software Bill of Materials (SBOM) to ensure component inventory and traceability,     addressing requirements from SR-4 and CM-8.   - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12.  |
+| [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative |
+| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in  NIST SP 800-190. It ensures that containerized applications follow  security best practices, including vulnerability scanning, trusted  image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls  throughout the software development lifecycle (SDLC), providing real-time  feedback to developers and enforcement in CI/CD pipelines.  |
+| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 |
+
+## Rules
+
+### SBOM
+
+**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. |
+| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. |
+| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier.  |
+| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. |
+| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | Verify the SBOM exists as evidence. |
+| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. |
+| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. |
+
+### Image SBOM
+
+**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. |
+| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. |
+| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. |
+| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. |
+| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date.  |
+| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided.  |
+| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. |
+| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. |
+| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS  |
+| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. |
+| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property.  |
+| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`.  |
+| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. |
+| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source.  |
+| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed.  |
+| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-users) | Verify specific users are not allowed in an SBOM. |
+| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies. |
+| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. |
+| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. |
+| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. |
+| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. |
+| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. |
+
+### Git SBOM
+
+**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. |
+| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. |
+| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. |
+| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. |
+| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. |
+
+### SARIF Evidence
+
+**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. |
+| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. |
+| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. |
+| [Verify Artifact Signature in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. |
+| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. |
+| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. |
+| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. |
+| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. |
+| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. |
+| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report |
+| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold.  |
+| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. |
+| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. |
+| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold |
+
+### Generic Statement
+
+**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists |
+| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. |
+| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. |
+
+### Github Organization Discovery Evidence
+
+**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. |
+| [Verify `secret_scanning_push_protection` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. |
+| [Verify `secret_scanning_validity_checks_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. |
+| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. |
+| [Verify `secret_scanning` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. |
+| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. |
+| [Verify `advanced_security_enabled_for_new_repositories` setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security` is enabled for new repositories in the GitHub organization. |
+| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. |
+| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. |
+| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. |
+| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. |
+| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. |
+| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. |
+| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. |
+| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. |
+| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. |
+| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). |
+| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. |
+| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. |
+| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. |
+| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. |
+
+### Github Repository Discovery Evidence
+
+**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. |
+| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. |
+| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. |
+| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. |
+| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. |
+| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. |
+| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. |
+| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. |
+| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. |
+| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. |
+| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. |
+| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. |
+| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. |
+| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. |
+| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. |
+| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. |
+
+### Gitlab Organization Discovery Evidence
+
+**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. |
+| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. |
+| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. |
+| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. |
+| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. |
+| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. |
+| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. |
+| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. |
+| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. |
+| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. |
+| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. |
+
+### Gitlab Project Discovery Evidence
+
+**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. |
+| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. |
+| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. |
+| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. |
+| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. |
+| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. |
+| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. |
+| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. |
+| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. |
+| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. |
+| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. |
+| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. |
+| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. |
+| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. |
+| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. |
+| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. |
+| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. |
+| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. |
+| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. |
+| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. |
+| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. |
+| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. |
+| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. |
+| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. |
+| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. |
+| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. |
+| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. |
+| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. |
+| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. |
+| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. |
+| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. |
+| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. |
+| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. |
+| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. |
+| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. |
+| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. |
+| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. |
+| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. |
+
+### K8s Namespace Discovery Evidence
+
+**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. |
+| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. |
+| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. |
+| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. |
+| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. |
+| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. |
+
+### K8s Pod Discovery Evidence
+
+**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. |
+| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. |
+| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. |
+
+### Bitbucket Project Discovery Evidence
+
+**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. |
+| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. |
+| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. |
+| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. |
+
+### Bitbucket Repository Discovery Evidence
+
+**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. |
+| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. |
+| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. |
+
+### Bitbucket Workspace Discovery Evidence
+
+**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. |
+| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. |
+
+### Discovery Evidence
+
+**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. |
+| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. |
+| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. |
+
+### Dockerhub Project Discovery Evidence
+
+**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. |
+| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. |
+
+### Jenkins Instance Discovery Evidence
+
+**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. |
+| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. |
+
+### SLSA Provenance
+
+**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. |
+| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. |
+| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. |
+| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. |
+| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. |
+| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. |
+| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. |
+
+### Statement
+
+**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. |
+| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules |
+| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. |
+| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository |
+| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image |
+| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface |
+| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM |
+| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private |
+| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins |
+| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code |
+| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository  |
+| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. |
+| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. |
+| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. |
+| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. |
+<!-- END TABLE -->
 
 ### General Information
 
diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh
index ce78c7d95..4f9f46d6d 100644
--- a/scripts/sync_docs.sh
+++ b/scripts/sync_docs.sh
@@ -4,7 +4,7 @@ submodules_dir="sub"
 [ ! -d "${submodules_dir}" ] && mkdir "${submodules_dir}"
 base="git@github.com:scribe-security"
 base_public="git@github.com:scribe-public"
-supported_repos=( "valint" "platforms_lib" "action-bom" "action-verify" "action-slsa" "action-installer" "orbs" "azure-tasks" "helm-charts" "valint-pipe" "gatekeeper-provider" "sample-policies" )
+supported_repos=(  "valint" "platforms_lib" "action-bom" "action-verify" "action-slsa" "action-installer" "orbs" "azure-tasks" "helm-charts" "valint-pipe" "gatekeeper-provider" "sample-policies" )
 
 pull_submodules() {
     repos=$1
@@ -17,10 +17,23 @@ pull_submodules() {
             repo_url="${base}/${repo}"
         fi
         repo_dir="${submodules_dir}/${repo}"
-        [[ ! -d "${repo_dir}" ]] && git clone --depth 1 "${repo_url}" "${repo_dir}"
+            if [ ! -z "$BRANCH" ]; then
+                git clone --depth 1 --branch "$BRANCH" "${repo_url}" "${repo_dir}"
+            else
+                git clone --depth 1 "${repo_url}" "${repo_dir}"
+            fi
         pushd "${repo_dir}"
-        git checkout master || git checkout main
-        git pull origin master || git pull origin main
+        # if BRANCH
+        if [ ! -z "$BRANCH" ]; then
+            git fetch origin $BRANCH
+            git checkout $BRANCH
+            git config pull.rebase false  # Or `true` if you prefer rebasing
+            git pull origin $BRANCH
+        else
+            git checkout master || git checkout main
+            git pull origin master || git pull origin main
+        fi
+        
         popd
     done
 }
@@ -34,8 +47,14 @@ checkout_submodules() {
         repo_dir="${submodules_dir}/${repo}"
         [[ ! -d "${repo_dir}" ]] && git clone --depth 1 "${repo_url}" "${repo_dir}"
         pushd "${repo_dir}"
-        git checkout master || git checkout main
-        git pull origin master || git pull origin main
+        if [ ! -z "$BRANCH" ]; then
+            git branch -D $BRANCH
+            git checkout -b $BRANCH
+        else
+            git checkout master || git checkout main
+            git pull origin master || git pull origin main
+        fi
+
         git branch -D doc_export
         git checkout -b doc_export
         popd
@@ -236,28 +255,40 @@ export_orbs() {
     export_file_rename ${repo} "" "${dst_dir}/circleci.md"
 }
 
-
 import_sample-policies() {
     repo="sample-policies"
     repo_dir="${submodules_dir}/${repo}"
     dst_dir="docs/guides"
 
-    echo '---
-sidebar_label: "Applying Policies to your SDLC"
-title: Applying Policies to your SDLC
-sidebar_position: 3
-toc_min_heading_level: 2
-toc_max_heading_level: 5
----' > "${dst_dir}/enforcing-sdlc-policy.md"
+    # Copy sample policy docs
+    cp -r "${repo_dir}/docs/v2/*" "docs/configuration/"
+
+    # Create a temporary file to hold the table content from index.md
+    tmpfile=$(mktemp)
+
+    # Extract everything between <!-- START TABLE --> and <!-- END TABLE --> from index.md
+    # (excluding the markers themselves) into tmpfile
+    sed -n '/<!-- START TABLE -->/,/<!-- END TABLE -->/ {
+        /<!-- START TABLE -->/d
+        /<!-- END TABLE -->/d
+        p
+    }' docs/configuration/initiatives/index.md > "${tmpfile}"
+
+    # Replace the block in enforcing-sdlc-initiative.md with the table content from tmpfile
+    sed -i '/<!-- START TABLE -->/,/<!-- END TABLE -->/{
+        /<!-- START TABLE -->/!{ /<!-- END TABLE -->/!d; }
+        /<!-- START TABLE -->/r '"${tmpfile}"'
+    }' "${dst_dir}/enforcing-sdlc-initiative.md"
 
-    tail -n +2 "${repo_dir}/README.md" >> "${dst_dir}/enforcing-sdlc-policy.md"
+    # Clean up
+    rm "${tmpfile}"
 }
 
 export_sample-policies() {
     repo="sample-policies"
     repo_dir="${submodules_dir}/${repo}"
     dst_dir="docs/guides"
-    export_file_rename ${repo} "" "${dst_dir}/enforcing-sdlc-policy.md"
+    export_file_rename ${repo} "" "${dst_dir}/enforcing-sdlc-initiative.md"
     sed -i '/^---$/,/^---$/c\
 # Sample policies' "${repo_dir}/README.md"
 }
@@ -376,7 +407,7 @@ EOF
 
 
 parse_args() {
-  while getopts "r:IESLdh?x" arg; do
+  while getopts "b:r:IESLdh?x" arg; do
     case "$arg" in
       x) set -x ;;
       r) repos+=(${OPTARG});;
@@ -384,6 +415,7 @@ parse_args() {
       E) COMMAND="export";;
       S) COMMAND="status";;
       L) LOCAL="true";;
+      b) BRANCH=${OPTARG};;
       h | \?) usage "$0" ;;
     esac
   done