A ConfigV2 represents a configuration object conforming to V.2 of the configuration schema.

A Source represents a remote repository in which vulnerability statements are stored.

A Policy determines how statements from different source repositories are to be merged (reconciled, when conflicting).