diff --git a/tech-debt.md b/tech-debt.md
index 25af093c..ba9fc362 100644
--- a/tech-debt.md
+++ b/tech-debt.md
@@ -8,9 +8,9 @@
 
 "Technical debt" is a term which refers to undesirable things about the way a system is built which are not apparent to users of the system, but impact the ability of the team to make changes to it quickly and safely. Tech debt arises due to processes or practices in the past, but has an ongoing impact on the present, in that it:
 
-*	Leads to bugs and loss of reliability
-*	Means changes take longer to develop, and makes it harder to predict how long the work will take
-*	Causes dissatisfaction and disengagement in the delivery team
+* Leads to bugs and loss of reliability
+* Means changes take longer to develop, and makes it harder to predict how long the work will take
+* Causes dissatisfaction and disengagement in the delivery team
 
 There are many different views on what is and isn't tech debt - this is ours.
 
@@ -41,6 +41,7 @@ Here is a non-exhaustive list of examples we consider to be *in* scope of "techn
 * Code you no longer need ([e.g. a new managed service is available](patterns/outsource-bottom-up.md))
 * Technologies no longer needed (e.g. you've introduced something better than what you used before)
 * CI issues, e.g. lack of [fast feedback](patterns/fast-feedback.md), or intermittent [build failures](practices/continuous-integration.md)
+* [Code-repository configuration issues](practices/security-repository.md), e.g. lack of branch protection rules
 * Manual processes that could be [automated](patterns/automate-everything.md)
 * Software components with inappropriate / confused [domain boundaries](patterns/architect-for-flow.md)
 * Use of obsolete / unsupported technologies