An alert can come late because many advisory databases separate reviewed records from unreviewed ones, and only reviewed ones trigger package alerts. A CVE that is public but still waiting for review can be invisible to the alert system even though the vulnerability is real.
Definitions
A reviewed advisory is one a database team has checked for validity and mapped to a package ecosystem, with a description and affected versions. An unreviewed advisory is a raw record imported from an upstream feed, with no such check.
GitHub's documentation states this plainly. Reviewed advisories cover supported ecosystems and are checked for a full description and ecosystem and package information. Unreviewed advisories are published automatically from the National Vulnerability Database feed and are not checked for validity or completion. Unreviewed advisories do not generate Dependabot alerts.
Why the split exists
Raw feeds are noisy. Some records have no package name, some name the wrong product, and some are later rejected. Alerting developers on every raw record would flood them with false matches. Review is the filter. The cost is delay, because review is a queue and a queue takes time.
GitHub also says new vulnerabilities may take time to appear in the advisory database and trigger alerts. The documentation gives no time window.
The gap in practice
Picture a CVE published on a Tuesday for a popular library. The record exists, but until it is reviewed and mapped, an alert tool that reads only reviewed data stays silent. A second tool that reads the raw feed might flag it at once, with some false matches mixed in. Neither is wrong. They made different trade offs.
How to cover the gap
- Know which sources each of your tools reads, and whether they alert on raw or reviewed data.
- Watch a small feed for high impact events, such as the KEV catalog, which lists vulnerabilities with confirmed exploitation.
- For critical dependencies, follow the maintainer's own security announcements.
- When a public CVE names a package you use and no alert has fired, check it by hand rather than waiting.
| Source type | Strength | Weakness |
|---|---|---|
| Raw feed | Early | Noisy, poor package mapping |
| Reviewed database | Accurate package data | Review delay |
| Maintainer announcement | Earliest and most precise | Scattered across projects |
Where Safeguard fits
Safeguard's zero-day discovery work targets issues before a formal advisory exists, and its dependency scanning matches reviewed data against your inventory. A free scan shows what your project contains today.
For more on how records change once published, see advisories change after publication.
Quick check
Does an unreviewed advisory mean the vulnerability is not real?
No. It means it has not been checked and mapped yet. It may be real, wrong, or incomplete.
Should I turn on alerts for raw records?
Only if you can absorb the noise. Many teams prefer reviewed alerts plus a manual watch on the KEV catalog.
Sources
- About the GitHub Advisory Database, GitHub Docs
- About Dependabot alerts, GitHub Docs
- Known Exploited Vulnerabilities Catalog, CISA
Last reviewed: 19 October 2026.
