This rule in herald acts on the text *removed* from the source as well as text added. This makes the rule unhelpful for a common use-case which is to detect certain text and create an audit. For example, creating an audit when the string "TODO" is detected.
Right now, an audit is created when that string is removed from the source, as well as when it is added.