Security
Alerts and the threat feed
Alerts is the queue of everything dependency scanning has raised across your monitored repositories. Threat feed is the advisory cache those scans match against, and you can search it directly.
Anyone with security access can read the queue and the threat feed. Resolving or dismissing a security alert, and starting a fix from a confirmed one, are admin tasks.
#Working the queue
Alerts
Every candidate and confirmed exposure across your monitored repositories. Open one to see the agent's verdict and evidence.
| Advisory | Package | Severity | Verdict |
|---|---|---|---|
| CVE-2025-41822 | tar-fs 3.0.4 | High | Confirmed |
| CVE-2025-38177 | undici 6.19.2 | Medium | Not affected |
| GHSA-8xq9-c2v7 | esbuild 0.21.5 | Low | Not affected |
Each row is one package in one repository, with its severity, its status and when it last changed. Search matches the package name or the advisory title, and the severity filter narrows to critical, high, medium or low.
The status tabs are how most people use this page. Confirmed is the working queue, Open is everything still live, and Not affected and Dismissed are the two ways something leaves it.
| Status | What it means |
|---|---|
| Open | Raised and still live, whether or not it has been assessed yet. |
| Confirmed | inline read your code and found the vulnerable path reachable. |
| Not affected | inline read your code and found the vulnerable path unreachable. |
| Dismissed | Someone on your team decided it needs no action. |
#Reading one
Open a security alert and the Agent assessment card shows the verdict, how confident inline was, and the reasoning behind it. The Advisory card underneath holds the published advisory itself.
The assessment is what makes a verdict worth acting on: it names where in your code the vulnerable path is reached, so you can check the reasoning rather than take the verdict on trust.
#Acting on one
Three actions sit at the top of a security alert. Resolve marks it dealt with, Dismiss takes it out of the queue, and Reopen puts a dismissed one back.
Create fix starts a remediation run against that security alert, which patches the dependency in a sandbox and opens a pull request. It appears on confirmed security alerts once remediation is on for that repository. See Remediation runs.
#The threat feed
Threat feed is the advisory cache itself, drawn from OSV, GitHub and NVD, and it is shared across every repository in the workspace. Filter it by ecosystem and by severity to see what has been published, whether or not it affects your code.
It is the page to open when a vulnerability is in the news and you want to know whether it is in the cache and which ecosystem it affects, before checking whether any of your repositories use the package.