Record an owner, a decision and a reason for each alert. GitHub lets you assign Dependabot alerts to people, teams or agents, and dismiss alerts you have assessed. Keep dismissals explained, review auto-dismiss rules on a schedule, and export alert data monthly so the history survives beyond the interface.
What GitHub documents
Dependabot scans the default branch and raises alerts when a new vulnerability enters the GitHub Advisory Database or when your dependency graph changes. Each alert includes the affected file, vulnerability details, severity and a fixed version when one exists.
Three features matter for evidence:
- Assignment. Users with write access or higher can assign alerts to collaborators, teams or AI agents. The documentation says assignment establishes clear ownership and prevents alerts being overlooked.
- Dismissal. You can dismiss open alerts that you have assessed, which also makes it easier to triage new ones.
- Auto-triage rules. The documentation recommends rules to auto-dismiss low-risk alerts, and notes that rules apply before notifications are sent.
The three things an auditor looks for
| Question | Record that answers it |
|---|---|
| Who is responsible for this finding? | Assignee on the alert |
| What did you decide? | Fixed by pull request, dismissed, or still open with a date |
| Why was that acceptable? | Dismissal reason and comment |
Process in five steps
- Enable alerts across the organization so no repository is silently missing.
- Assign each new alert to an owner within a few working days. Pick the number and write it in your policy.
- For a fix, link the pull request. For a dismissal, write a reason that a stranger could understand.
- If you use auto-triage rules, write each rule down with an author and a date, and review the list every quarter. A rule is a standing decision that closes alerts without a person looking.
- Export alerts monthly and file the JSON.
A caution on auto-dismiss
Auto-triage rules cut noise, which is valuable. They also create dismissals no human reviewed. Treat the rule as the reviewed item: who approved it, what it covers, when it is next checked. Auditors tend to accept a documented rule more readily than a pile of unexplained closures.
Link to your service levels
If your policy says high severity items are handled within a set number of days, the evidence is the alert creation time against the fix or dismissal time. Make sure you can compute that from the export. Our guide on vulnerability management evidence lists what else to gather.
Try it yourself
Click through it at your own pace, or open it full screen. Follow one finding from detection to closure and note which fields you would export.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning with reachability analysis, so you can see which vulnerable packages your code actually calls, plus compliance and evidence automation. Try the free scan.
Quick check
Can I assign a Dependabot alert to a team?
Yes. The documentation says users with write access or higher can assign alerts to collaborators, teams or agents.
Do auto-dismissed alerts send notifications?
No. The documentation says rules apply before notifications are sent, so auto-dismissed alerts do not notify anyone.
Sources
Last reviewed: 19 October 2026.
