Description
A scanner can tell you a package has a known CVE, but with hundreds of alerts, severity alone doesn't always tell you what matters. In this Security in 60 Seconds short, Carlin Cherry walks through three more questions to ask: Is the dependency actually used? Can your application reach the vulnerable code? Is it exposed in a production path? Reachability analysis and production context in Dependabot help answer them. Treat them as starting points alongside severity and EPSS, and choose the signals that fit your team.
Learn more about reachability analysis: https://gh.io/reachability
Learn more about production context: https://docs.github.com/en/code-security/tutorials/secure-your-organization/prioritize-alerts-in-production-code
Music credits:
ahpook: https://ahpook.bandcamp.com/track/a
#Security #Dependabot #GitHub
Stay up-to-date on all things GitHub by connecting with us:
YouTube: https://gh.io/subgithub
Blog: https://github.blog
X: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Insider newsletter: https://resources.github.com/newsletter/
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
About GitHub
It’s where over 180 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com