Simplify documentation

Author: karenjli

content/integrations/integrating-npm-with-external-services/using-private-packages-in-a-ci-cd-workflow.mdx

@@ -46,10 +46,8 @@ If trusted publishing is not available for your CI/CD provider, you can create a
 **Security considerations for bypass 2FA:**
 
 - Only enable bypass 2FA when necessary for automated publishing workflows
-- Use the most restrictive permissions possible (limit to specific packages/scopes)
-- Set short expiration dates for tokens with bypass 2FA enabled
-- Consider using IP address restrictions to limit where the token can be used
-- Regularly audit and rotate tokens with bypass 2FA capabilities
+- Use restrictive permissions and short expiration dates
+- Consider IP address restrictions and regular token rotation
 - Use trusted publishing instead of bypass 2FA tokens whenever possible
 
 </Note>

content/packages-and-modules/securing-your-code/requiring-2fa-for-package-publishing-and-settings-modification.mdx

@@ -14,9 +14,10 @@ For CI/CD workflows, consider using [trusted publishing](/trusted-publishers), w
 
 **Important notes about granular access tokens:**
 
-- **When bypass2FA is true**: The token will bypass all 2FA requirements at all times, regardless of account-level or package-level 2FA settings
-- **When bypass2FA is false (default)**: The system will check account-level and package-level settings to determine if 2FA is required
-- When "disallow tokens" is selected at the package level, granular access tokens cannot be used regardless of their bypass 2FA setting
+- Bypass 2FA configuration is set at token creation
+- When **bypass 2FA is disabled**: The system will check account-level and package-level settings to determine if 2FA is required
+- When **bypass 2FA is enabled**: The token will bypass all 2FA requirements at all times, regardless of account-level or package-level 2FA settings
+- When **Require two-factor authentication and disallow tokens** is selected at the package level, granular access tokens cannot be used regardless of their bypass 2FA setting
 
 </Note>