Skip to main content

Retiring

Expected​

SectionItemPriority GroupDetails
7. Code QualityTraining on Secure Software DesignP0details
7. Code QualityTraining on OWASP Top 10 or EquivalentP0details
1. User AuthenticationEnforce MFA in GitHub Organization(s)P1details
1. User AuthenticationEnforce MFA in npm Organization(s)P1details
1. User AuthenticationEnforce MFA in all the toolsP1details
1. User AuthenticationUse MFA against impersonationP1details
3. Service AuthenticationCheck sensitive informationP2details
3. Service AuthenticationEnsure that the secrets are injected at runtimeP2details
1. User AuthenticationUse SSH Keys with Passphrases for Repository AccessP3details
3. Service AuthenticationPublish to npm Using MFA-Enabled AccountsP3details
3. Service AuthenticationSecure GitHub Webhooks with SecretsP3details
2. User Account PermissionsRestrict Default GitHub Org Member PermissionsP4details
2. User Account PermissionsAllow Only Admins to Create Public RepositoriesP4details
2. User Account PermissionsPrevent Admins from Bypassing Branch ProtectionP4details
2. User Account PermissionsDefine Roles Aligned to Functional ResponsibilitiesP4details
2. User Account PermissionsDefine Teams/Individuals with Write Access to RepositoriesP4details
2. User Account PermissionsConfigure Two or more Owners for Access ContinuityP4details
11. Dependency ManagementAutomate Dependency Vulnerability IdentificationP6details
6. Coordinated Vulnerability DisclosureEnsure Security.md Meets OpenJS CVD GuidelinesP7details
6. Coordinated Vulnerability DisclosureUse CVD Tools to Manage Vulnerability ReportsP7details
6. Coordinated Vulnerability DisclosureDefine Clear Communication and Incident Response PlansP7details
6. Coordinated Vulnerability DisclosureAssign CVEs to All Known Security VulnerabilitiesP7details
6. Coordinated Vulnerability DisclosureInclude CVE IDs in Release Notes for Security FixesP7details
4. Github Workflow PermissionsPrevent Workflows from Creating or Approving PRsP9details
9. Source ControlDisable Force Push on Default BranchP9details
9. Source ControlPrevent Deletion of Default BranchP9details
9. Source ControlRequire Default Branch Updates Before MergingP9details
4. Github WorkflowsDisable Self-Hosted Runners in GitHub OrgP10details
4. Github WorkflowsLimit Workflow Write Permissions to Job-LevelP11details
10. Dependency InventoryAutomate Monitoring of Outdated DependenciesP14details
10. Dependency InventoryProvide Machine-Readable Dependency ListsP14details
10. Dependency InventoryUniquely Identify Modified DependenciesP14details
SectionItemPriority GroupDetails
1. User AuthenticationUse AAL2/3 Passkeys for GitHub AccessR1details
1. User AuthenticationUse AAL2/3 Passkeys for Non-Interactive GitHub AccessR1details
1. User AuthenticationUse AAL2/3 Passkeys in All Other ContextsR1details
4. Github WorkflowsRequire Approval for Forked Workflow ChangesR2details
4. Github WorkflowsUse Workflow Security ScannersR2details
4. Github WorkflowsUse GitHub Runner Security ScannersR2details
9. Source ControlRequire Pull Requests Before MergingR4details
9. Source ControlEnforce Commit Signoff for Web-Based CommitsR4details
9. Source ControlRequire Signed CommitsR4details
10. Dependency InventoryInclude package-lock.json in Releases (Freestanding Apps)R5details
9. Source ControlRequire Approved PRs for Mainline Commits (Two+ Maintainers)R6details
2. User Account PermissionsLimit GitHub Org Owners to Fewer Than ThreeR7details
2. User Account PermissionsLimit GitHub Repo Admins to Fewer Than ThreeR7details