> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/customization/policies/best-practices.md).

# Use the default policy with best practices

Qwiet offers a variation of the default policy with sensitive data dictionary that includes best practices. With this policy, Qwiet will show findings that are violations of best practices violations and attacker-reachable findings.

For example, one such finding might be a SQL injection vulnerability involving a string append operation that isn't attacker reachable. Another might involve code that dynamically generates SQL statements. These finding would be shown in the Qwiet Dashboard and flagged as `info`.

## Usage <a href="#usage" id="usage"></a>

To use this policy, modify your invocation of `sl analyze` to include the `--policy` flag and the name of the policy as follows:

```
sl analyze --policy io.shiftleft/defaultWithDictAndBestPractices --app yourAppName ...
```

![](/files/DfHDmRpYn5HJOmhRtTva) ![](/files/P5vj8JOtHNJWVEvAqKym)

> The use of this policy will likely increase the number of findings for your app, and it may slow down the speed of analysis.