> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing Credentials Incident Response

> Explains how Dependabot and the GitHub Advisory Database detect, alert on, and remediate vulnerable open source dependencies, plus configuration and workflows for updates.

Managing open-source vulnerabilities is a major challenge when much of your application is built from third-party components. Modern applications frequently reuse libraries and packages: in some organizations up to 80% of code comes from external sources.

![A presentation slide reading "Most of Your Code Is Borrowed" with a large "80%" displayed. Below it is a grid diagram labeled "Your application" showing many component blocks, a few highlighted in blue and several outlined in red with warning icons.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Securing-Credentials-Incident-Response/borrowed-code-80-percent-application-grid.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=57a556d2d7367e7fc62da2dc16f2ca23)

This article explains how Dependabot uses the GitHub Advisory Database to detect and remediate vulnerable dependencies, and how you can configure and operationalize those protections in your projects.

Why supply-chain security matters

* Most apps are assembled from open-source packages rather than written entirely from scratch.
* Vulnerabilities in a widely used dependency can affect many projects.
* Automated tooling that links vulnerability intelligence to your manifests is the first layer of defense.

Example minimal Node.js manifest:

```json theme={null}
{
  "name": "checkout-service",
  "dependencies": {
    "express": "^4.18.2"
  }
}
```

Dependabot: source of intelligence
Dependabot’s vulnerability intelligence is powered by the GitHub Advisory Database — a curated set of advisories (including mapped CVE entries) that links known vulnerabilities to specific package ecosystems and versions.

![A screenshot of a "GitHub Advisory Database" panel titled "Its Source of Truth," showing badges for "Curated" and "Globally recognized." The panel lists several CVE vulnerability entries (e.g., CVE-2021-23337, CVE-2021-44228).](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Securing-Credentials-Incident-Response/github-advisory-database-source-of-truth.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=c62f26006f1f9d28c1c7cff9e27c9d81)

How Dependabot works — three modes
Dependabot operates in three complementary modes. Configure and use each mode according to your risk tolerance and release processes.

| Mode | Purpose | What it does | Typical workflow |
| - | - | - | - |
| Dependabot alerts (passive detection) | Identify known vulnerable dependency versions | Scans manifest files (for example, `package.json`, `requirements.txt`) and raises alerts when a dependency version matches a database advisory | Review alerts in the repository, prioritize fixes |
| Dependabot security updates (active remediation) | Automatically propose minimal fixes for known vulnerabilities | Opens pull requests that upgrade vulnerable packages to the nearest non-vulnerable version | Review the PR, run CI, merge if tests pass |
| Dependabot version updates (preventive maintenance) | Reduce future upgrade risk by keeping dependencies current | Proactively opens PRs for routine dependency updates even when no CVE exists | Schedule regular reviews and merges to avoid large upgrade gaps |

Detailed examples and snippets

1. Dependabot alerts (passive detection)

* What it does: Scans your manifest files (for example, `package.json` for Node.js or `requirements.txt` for Python), cross-references package versions against the GitHub Advisory Database, and raises an alert when a known vulnerable version is in use.

Example vulnerable manifests:

package.json (excerpt)

```json theme={null}
{
  "dependencies": {
    "lodash": "4.17.19"
  }
}
```

requirements.txt

```text theme={null}
Django==2.2.10
requests==2.19.1
```

2. Dependabot security updates (active remediation)

* What it does: When an alert is triggered, Dependabot can automatically open a pull request that upgrades just the vulnerable dependency to the nearest safe version. Your workflow is to review the PR, run CI, and merge if everything looks good.

Example of the change in a PR (diff-style):

```diff theme={null}
package.json
-  "lodash": "4.17.19"
+  "lodash": "4.17.21"
```

3. Dependabot version updates (preventive maintenance)

* What it does: Proactively opens pull requests to keep dependencies up to date even when there are no known CVEs. This reduces the risk of large, risky upgrades later and lessens the chance you’ll be multiple major versions behind when a zero-day appears.

Example configuration (`.github/dependabot.yml`):

```yaml theme={null}
version: 2

updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
```

Why incremental updates matter
Keeping dependencies incrementally updated reduces the complexity and risk of emergency upgrades when vulnerabilities are disclosed. A smaller, frequent upgrade surface is easier to test and review than a large, infrequent one.

![A slide titled "Why It Matters" showing a horizontal version timeline with your app at v12 (highlighted in red with a lightning bolt) and the current release at v17 (green). Intermediate versions v13–v16 appear as neutral gray circles between them.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Securing-Credentials-Incident-Response/app-v12-lightning-v17-timeline.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=2ed25e3ff8880e1fccf2bea688863ce9)

Dependabot’s vulnerability intelligence comes from the GitHub Advisory Database. Use alerts to discover exposed dependencies, security updates to automatically remediate known issues, and version updates to proactively reduce future exposure.

Links and references

* [Dependabot documentation — Keeping your dependencies up to date automatically](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-up-to-date-automatically)
* [GitHub Advisory Database](https://github.com/advisories)
* [CVE (Common Vulnerabilities and Exposures)](https://cve.mitre.org)

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/cc9237d7-0938-4678-8851-40455ee1daff)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.