From 133f69b395e476fea188a93ecdad196c338da1c4 Mon Sep 17 00:00:00 2001 From: Bill Murdock Date: Thu, 3 Sep 2026 10:32:22 -0400 Subject: [PATCH] docs: describe partial-credit pass range for dependency_security The dependency_security section claimed a flat pass threshold of 60 points, but DependencySecurityAssessor passes any score >= 30: scores of 30-59 pass with partial credit and attached remediation, and only scores below 30 fail. Update docs/attributes.md to match the code. Co-Authored-By: Claude Fable 5 --- docs/attributes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/attributes.md b/docs/attributes.md index acc7a482..ac84c261 100644 --- a/docs/attributes.md +++ b/docs/attributes.md @@ -778,7 +778,7 @@ The assessor checks for recognized security tools: - **Semgrep** (multi-language SAST) — 15 pts - **SECURITY.md** present — 5 pts bonus -**Pass threshold**: 60 points. +**Pass threshold**: 60+ points is a full pass. Scores of 30-59 still pass with partial credit, but the finding includes remediation guidance for adding more scanning tools. Scores below 30 fail. **Tools checked**: pip-audit, safety, dependabot, snyk, trivy, grype, osvscanner, bandit (Python); npm audit, yarn audit (JavaScript/TypeScript); CodeQL, Semgrep, gitleaks, detect-secrets (multi-language).