Type qualifiers into the GitHub Advisory Database search box. For example, ecosystem:npm severity:high type:reviewed narrows results to reviewed high severity npm advisories. Other qualifiers filter by credit, withdrawn status and publication date.
Why use qualifiers
A raw search for a package name returns advisories of all types and ecosystems. Qualifiers cut that down so you can answer a specific question, such as "which high severity advisories were published for our ecosystem this week" or "has this advisory been withdrawn".
GitHub's documentation for browsing the database describes the sidebar for exploring reviewed and unreviewed advisories separately and filtering by ecosystem, and lists qualifiers you can type into the search.
The qualifiers worth knowing
| Qualifier | Effect, per the GitHub documentation |
|---|---|
| type:reviewed | GitHub-reviewed advisories for security vulnerabilities |
| type:unreviewed | Unreviewed advisories |
| ecosystem:npm | Only advisories in that ecosystem, replace npm with another name |
| severity:high | Only advisories at that severity level |
| credit:octocat | Only advisories credited to that user account |
| is:withdrawn | Only advisories that have been withdrawn |
You can also search for advisories created on a certain date, in a specific ecosystem, or for a particular library. Qualifiers can be combined, separated by spaces.
Reviewed or unreviewed
The default view shows GitHub-reviewed advisories for security vulnerabilities. This matters for tooling. GitHub states that Dependabot does not create alerts for unreviewed advisories because that type of advisory is not checked for validity or completeness. If you want to see everything that exists for a package, search type:unreviewed as well and read those records with more caution.
Malware advisories are shown separately. The documentation says to use a malware option or the type:malware search to see them.
Three searches to try
- Weekly sweep: ecosystem:npm severity:high type:reviewed, then sort by newest. Check each package name against your inventory.
- Withdrawn check: is:withdrawn plus a package name, when a scanner finding vanished and you want to know why.
- Unreviewed look: type:unreviewed plus a library you depend on, to see claims that are not yet checked.
Our post on what to do when an advisory is withdrawn covers the second case.
What the search cannot tell you
The database tells you what is known about a package. It cannot tell you which packages you run, or whether your code calls the vulnerable function. For that you need an inventory and some form of usage analysis.
It also does not cover every project's announcements. A fix can exist in release notes before it has an advisory record, so keep release feeds in the mix.
Where Safeguard fits
Safeguard pulls advisory data into its SBOM and dependency scanning so the match to your versions happens for you. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Does Dependabot alert on unreviewed advisories?
No. GitHub's documentation says it does not create alerts for unreviewed advisories because they are not checked for validity or completeness.
How do I see withdrawn advisories?
Search with the is:withdrawn qualifier in the GitHub Advisory Database.
Sources
- GitHub Docs: browsing security advisories in the GitHub Advisory Database
- GitHub Docs: about the GitHub Advisory Database
Last reviewed: 19 October 2026.
