safetyScore.areas in each repository’s default-branch .mergewatch.yml.
How org areas combine with repo areas
At review time, the enabled org areas whose scope includes the repository are added to the repository’s own areas, and every area is matched against the changed files. The riskiest matching level wins, so a repository can add areas but can never weaken one defined here: if the org markspayments/** as risky and a repository marks it safe, the result is risky.
In the review comment, a matched org area is marked (org), because the repository’s .mergewatch.yml does not show it. The mw-safety data line lists it under its plain name.
Fields
An area with neither file patterns nor notes is dropped when you save. An installation can have at most 50 org areas.