Repository has Dependabot vulnerability alerts enabled

Check ID: repository_dependency_scanning_enabled
Provider: GitHub
Service: repository
Severity: HIGH
Categories: vulnerabilities, software-supply-chain
Resource type: NotDefined

What this check verifies

GitHub repositories are assessed for dependency vulnerability scanning enabled via Dependabot alerts, which monitors the dependency graph for known vulnerable packages and versions.

Risk

Without automated scanning, known vulnerable dependencies may persist unnoticed, enabling supply-chain compromise. Exploits in third-party libraries can drive RCE, data theft, or build tampering, undermining confidentiality, integrity, and availability across code and CI/CD.

Recommendation

Enable dependency vulnerability scanning with Dependabot alerts or an equivalent SCA tool across repositories. Apply defense in depth: keep manifests and lockfiles current, triage alerts quickly, use automated security updates with required reviews, and surface results in PR checks and notifications.

Remediation

CLI
Terraform
Dashboard steps

gh api —method PUT repos/<OWNER>/<REPO>/vulnerability-alerts

resource "github_repository" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  vulnerability_alerts = true  # Enables Dependabot alerts to pass the check
}

References

https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts

Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = repository_dependency_scanning_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GitHub checks

Repository default branch requires status checks Repository has a CODEOWNERS file

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires