For a small team on GitHub with common ecosystems, Dependabot can be enough to start. It raises alerts and opens update pull requests. It does not give you cross repository inventory, reachability, exception tracking, or evidence for others, so add those when the questions come.
What Dependabot does
Per GitHub's documentation, alerts come from the GitHub Advisory Database, and just reviewed advisories raise alerts. Alerts trigger when a new advisory is added or the dependency graph changes. Security updates open pull requests for vulnerable dependencies, while version updates keep dependencies current and use a default three day cooldown that does not apply to security updates.
Limits GitHub states
- Alerts cannot catch every security issue.
- New vulnerabilities can take time to appear in the database.
- Archived repositories are not scanned.
- For GitHub Actions, just actions using semantic versioning generate alerts, not those pinned by SHA.
- Alerts for issues that existed when you enabled it are not sent as notifications.
What you still need to decide
| Question | Dependabot alone | What helps |
|---|---|---|
| Which service is affected by a new advisory? | Per repository view | Cross repository inventory |
| Is the vulnerable code called? | Not answered | Reachability analysis |
| Who accepted this risk, until when? | Dismissal reasons | Exception records with expiry |
| What do I show a customer? | Alert lists | Exported evidence |
When it is enough
One organisation on GitHub, a few repositories, mainstream languages, no customer evidence requests yet. In that case turn on alerts and security updates, assign an owner, and review weekly.
When to add more
When you leave GitHub for another source host, when questionnaires ask for history, or when alert volume exceeds review time. Use a one afternoon trial against your own repositories to see what else turns up.
Safeguard covers this ground with SBOM and dependency scanning, reachability analysis, policies and gates, and compliance evidence automation. Autonomous fix PRs are off by default, with every category set to Manual. You can try a free scan at gold.safeguard.sh/scan.
Get more from it first
Before adding tools, use what you have. Turn on security updates, group related updates to reduce pull request volume, require tests to pass before merging, and assign a weekly owner for the alert queue. Review dismissed alerts monthly, since dismissal reasons are your just record of accepted risk. Many small teams find that discipline around Dependabot closes more risk than a new tool would.
Try it yourself
Click through it at your own pace, or open it full screen. See what an update pull request needs to carry so a reviewer can merge it quickly.
Quick check
Does Dependabot scan archived repositories?
No. GitHub's documentation says archived repositories are not scanned.
Do I still need review of update pull requests?
Yes. Updates can break builds, so keep tests and a reviewer in the loop.
Sources
Last reviewed: 19 October 2026.
