Secure your software supply chain
Avoid adding new vulnerabilities with dependency review. Your software is more than the code you have written. With up to 94% of active repositories relying on open source, you rely on many components you didn’t produce, but which you still need to secure.
Review changes
Review dependency changes in relevant context like pull requests and issues
Fix vulnerabilities
Fix vulnerable dependencies by raising pull requests with security updates
Prevent
Keep the packages you use updated to the latest versions
Get notified of new vulnerabilities
Keep your dependencies up-to-date and optimized and get updates on new vulnerabilities affecting your specific dependencies with Dependabot.
Identify your dependencies, dependents, and their properties to understand your software supply chain.
Discover your dependencies using GitHub’s dependency graph, including transitive dependencies.
How GitHub’s dependency graph is generated
Review, fix and publish issues securely. Contribute and refer to a curated, open-source database of vulnerabilities.
GitHub Advisory Database
Develop a private fix and publish an advisory about a vulnerability in your project, and share your reporting and disclosure policy with the world.
Publish a repository security advisory
Secure software from the start
Whether you’re contributing to an open source project or choosing new tools for your team, your security needs are covered.
