/**
 * WGL036: Privileged Service / Docker-in-Docker Reachable from Merge Requests
 *
 * Flags a job that uses Docker-in-Docker (a privileged service) and is reachable
 * from merge-request pipelines. MR pipelines can run code from an outside
 * contributor; a privileged DinD service shares the host daemon socket and can
 * be used to escape the build and reach the runner. Restrict privileged services
 * to protected refs, or require approval before such jobs run.
 *
 * Complements WGL026 (DinD without TLS) by adding the trust-boundary dimension.
 */
import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
export declare const wgl036: PostSynthCheck;
//# sourceMappingURL=wgl036.d.ts.map