Security
Security monitoring
inline watches the dependencies of the repositories you enable, matches them against published advisories, and checks each candidate match against your actual code before it raises a security alert.
Turning monitoring on for a repository and setting its threshold are admin tasks. Everyone with security access can read what the scans found.
#Turning it on for a repository
Security
Continuous supply-chain & CVE monitoring for your repositories. Candidate exposures are verified by an agent against your actual code before they reach you.
Monitored repos
14
Confirmed exposures
3
Awaiting assessment
7
Assessment spend
$•.••
Confirmed by severity
Monitored repositories
The Monitored repositories card lists every connected repository with a switch. Turn one on and inline resolves its dependency tree, then keeps watching it.
Each enabled repository has three controls of its own. Alert ≥ sets how severe a confirmed exposure has to be before you hear about it, Email decides whether it also arrives by email, and GitHub alerts pulls in what GitHub's own Dependabot, code scanning and secret scanning already found. Scan now runs a pass immediately rather than waiting for the next one.
#What a scan does
A scan resolves your dependencies, matches them against the advisories in the threat feed, and then assesses each match. The assessment is the part that matters: inline reads the code where the vulnerable package is actually used and decides whether your repository is exposed.
| Verdict | What it means |
|---|---|
| Confirmed | The vulnerable code path is reachable in your repository. This is what your team sees. |
| Not affected | The package is present, but the vulnerable path is unused or unreachable as your code calls it. |
So the number your team sees is the number of exposures that apply to your code, and a dependency listed in an advisory you do not call ends up as Not affected rather than in the queue.
#Reading the Security Overview
Four totals sit across the top: Monitored repos, Confirmed exposures, Awaiting assessment and Assessment spend. The first two are what to watch day to day, and Awaiting assessment is what the scan has matched but has yet to check against your code.
Confirmed by severity splits the open exposures by severity, and Recent confirmed exposures lists the newest. Latest threat intel shows advisories that touch packages you use, whether or not a scan has assessed them yet.
#Choosing a threshold
Alert ≥ decides how much your team hears about. Set it low on a repository that handles customer data; an internal tool your team already reviews closely can sit higher, so its confirmed exposures still appear on the Security Overview without emailing anyone.
Anything below the threshold is still scanned and still assessed. It is counted under Awaiting assessment and listed with the rest, and no security alert is raised.
Security monitoring is included with Pro. See Plans and billing.