Why every project needs a dependency manifest
Why it matters
Without requirements.txt, pyproject.toml, package.json or go.mod nobody can rebuild the environment, and no scanner can tell you which dependency is vulnerable.
How to fix it
What to do: Create
requirements.txt with pinned versions.# Generate from current environment:
pip freeze > requirements.txt
# Or use pip-tools for clean separation:
pip install pip-tools
# requirements.in — direct deps only:
echo "django>=4.2" > requirements.in
pip-compile requirements.in # generates requirements.txt
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.