Scorecard scores Branch-Protection in tiers. If a setting from a lower tier is missing, the score is capped at that tier's maximum, however many higher settings you meet. So enable the basics first: block force pushes and deletions, then require reviews and status checks, and apply the rules to administrators.
How the tiers behave
The Scorecard FAQ states that if a Tier 1 setting is not satisfied, it does not matter that all other settings are met, because the score is truncated up to the tier's maximum. It publishes a table mapping settings to tiers, and notes that some settings need an admin token to verify. An outside scan may therefore read lower than your real configuration.
The check is rated High, and it applies to the default branch and release branches.
What to enable
The checks documentation says the check wants branch protection or rulesets that block force pushes and deletion, require reviews and require status checks. GitHub's protected branch documentation describes the available settings.
- Force pushes and deletions: blocked by default on protected branches. Leave them blocked.
- Pull request reviews: require at least one approving review. You can dismiss stale approvals when new commits change the diff, and require that someone other than the last pusher approves.
- Status checks: require your test and scanning checks to pass. Strict mode also requires the branch to be up to date with the base.
- Conversation resolution: optional, but it keeps review comments from being ignored.
- Bypass control: by default, administrators and roles with the bypass permission are exempt. You can enforce the rules on them as well.
Rulesets versus classic rules
GitHub notes that for classic branch protection only a single rule can apply at a time, which makes overlapping patterns hard to predict. Rulesets do not have that limit, and existing rules can be converted. Scorecard's documentation mentions both rules and rulesets.
The related Code-Review check
Code-Review, also High risk, looks at about the last 30 commits and asks whether someone other than the committer approved or merged them. Bot reviews do not count. If you are the only maintainer, this check will stay low unless you recruit a second reviewer. That is a structural limit, not a configuration error.
Verify
Run the Scorecard CLI with the show-details flag and read the Branch-Protection reasons. If it reports that it could not read settings, run it with a token that has the needed repository permissions.
Safeguard policies and gates can add a further control on the pull request itself, checking findings before merge.
Quick check
Why does my score stay low with reviews enabled?
A missing lower tier setting, such as allowing force pushes, caps the score. Check the FAQ tier table and fix the lowest gap first.
Sources
Last reviewed: 19 October 2026.
