GitHub
Security & compliance
Code quality
Releases
Supply-chain alerts
The GitHub security alerts nobody has opened.
Overview
Pulls Dependabot, code scanning, and secret scanning alerts from the live GitHub security API and folds them into the same scored report as everything else. Metadata only — the secret value is never read.
What it looks for
- Known-vulnerable dependencies reported by Dependabot
- Open code-scanning (SAST) alerts
- Active leaked secrets from secret scanning
Why it matters
These alerts are already sitting in a tab of your repository. They rot there because they are in a different place from the rest of your work, and an active leaked-secret alert is an incident, not a notification.
Rules in this check
| What it reports | Fix path |
|---|---|
| Known-vulnerable dependency (Dependabot) | Guide |
| Open code-scanning (SAST) alert | Guide |
| Active leaked secret (secret scanning) | Guide |
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.