diff --git a/docs/checks.md b/docs/checks.md index c05a84e6974..620140f11e2 100644 --- a/docs/checks.md +++ b/docs/checks.md @@ -102,7 +102,7 @@ Note: If Scorecard is run without an administrative access token, the requiremen Tier 1 Requirements (3/10 points): - Prevent force push - Prevent branch deletion - - For administrators: Do not allow bypassing the above settings + - For administrators: Include administrator for review Tier 2 Requirements (6/10 points): - Required reviewers >=1 diff --git a/docs/checks/internal/checks.yaml b/docs/checks/internal/checks.yaml index a8ba343a069..a3d6eeeb663 100644 --- a/docs/checks/internal/checks.yaml +++ b/docs/checks/internal/checks.yaml @@ -502,7 +502,7 @@ checks: remediation: - >- If your project is producing an application, declare all your dependencies with specific versions in your package - format file (e.g. `package.json` for npm, `requirements.txt` for python). + format file (e.g. `package.json` for npm, `requirements.txt` for python, `packages.config` for nuget). For C/C++, check in the code from a trusted source and add a `README` on the specific version used (and the archive SHA hashes). - >-