GitHub · GH-500
Dependabot alerts and security updates
GH-500 · Lesson 8 of 16 · 1:01:06
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: prioritizing Dependabot alerts with severity, EPSS, scope, and production context, security update pull requests and grouped security updates, remediation at scale with assignments, and Dependabot auto-triage rules, with GitHub presets and custom rules. Includes three original practice questions.
Preview the topics
- Contoso can fix only 20 of its 1,200 alerts this week, and wants the ones most likely to be exploited in production. Which signals should it filter on?
- Contoso’s npm repositories get 30 separate security update pull requests every week, and reviewers are overwhelmed. What should the team enable?
- Contoso wants low severity alerts in development dependencies to be dismissed automatically across the organization, without sending a single notification. What should the security team create?