Where can you find the vulnerable dependencies that GitHub detected in your repository?

Question

Options

• Ain security advisories
• Bin code scanning alerts
• Cin secret scanning alerts
• Din Dependabot alerts

• B
  5% (1)
• C
  5% (1)
• D
  90% (19)

Explanation

Dependabot alerts are the dedicated feature for surfacing vulnerable dependencies detected in your repository. They appear in the repository's Security tab under 'Dependabot alerts' and provide details about each vulnerability, its severity, affected package, and remediation suggestions. Security advisories (A) are community-authored documents about vulnerabilities, not a list of what affects your specific repo. Code scanning alerts (B) surface issues found by static analysis in your own source code, not in dependencies. Secret scanning alerts (C) flag exposed credentials or tokens, not vulnerable packages.

No community discussion yet for this question.