diff --git a/content/code-security/concepts/supply-chain-security/about-dependabot-alerts.md b/content/code-security/concepts/supply-chain-security/about-dependabot-alerts.md index 8d24d59b6d75..d90838a1a7a6 100644 --- a/content/code-security/concepts/supply-chain-security/about-dependabot-alerts.md +++ b/content/code-security/concepts/supply-chain-security/about-dependabot-alerts.md @@ -44,16 +44,33 @@ When {% data variables.product.github %} detects a vulnerable dependency, a {% d * Details about the vulnerability and its severity * Information about a fixed version (when available) -For information about notifications, viewing, and managing alerts, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts). +For information about viewing and managing alerts, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts). ## Enabling alerts -Repository administrators and organization owners can enable {% data variables.product.prodname_dependabot_alerts %} for their repositories{% ifversion fpt or ghec %} and organizations{% endif %}. When enabled, {% data variables.product.github %} immediately generates the dependency graph and creates alerts for any vulnerable dependencies it identifies. By default, people with write, maintain, or admin permissions receive notifications.{% ifversion fpt or ghec %} Repository administrators can grant access to additional people or teams.{% endif %} +Repository administrators and organization owners can enable {% data variables.product.prodname_dependabot_alerts %} for their repositories{% ifversion fpt or ghec %} and organizations{% endif %}. When enabled, {% data variables.product.github %} immediately generates the dependency graph and creates alerts for any vulnerable dependencies it identifies. {% ifversion fpt or ghec %} Repository administrators can grant access to additional people or teams.{% endif %} {% data reusables.repositories.enable-security-alerts %} See [AUTOTITLE](/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts). +## Notifications for alerts + +By default, {% data variables.product.github %} sends email notifications about new alerts to people who both: + +* Have write, maintain, or admin permissions to a repository +* Are watching the repository and have enabled notifications for security alerts or for all activity on the repository + +{% ifversion fpt or ghec %} +You can override the default behavior by choosing the type of notifications you want to receive, or switching notifications off altogether in the settings page for your user notifications at [https://github.com/settings/notifications](https://github.com/settings/notifications). +{% endif %} + +Regardless of your notification preferences, when {% data variables.product.prodname_dependabot %} is first enabled, {% data variables.product.github %} does not send notifications for all vulnerable dependencies found in your repository. Instead, you will receive notifications for new vulnerable dependencies identified after {% data variables.product.prodname_dependabot %} is enabled, if your notification preferences allow it. + +If you are concerned about receiving too many notifications, we recommend leveraging {% data variables.dependabot.auto_triage_rules %} to auto-dismiss low-risk alerts. Rules are applied before alert notifications are sent, so alerts that are auto-dismissed upon creation do not send notifications. See [AUTOTITLE](/code-security/dependabot/dependabot-auto-triage-rules/about-dependabot-auto-triage-rules). + +Alternatively, you can opt into the weekly email digest, or even completely turn off notifications while keeping {% data variables.product.prodname_dependabot_alerts %} enabled. + ## Limitations {% data variables.product.prodname_dependabot_alerts %} have some limitations: diff --git a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-notifications-for-dependabot-alerts.md b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-notifications-for-dependabot-alerts.md index 7a5bf9112ef6..a1c46bedd080 100644 --- a/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-notifications-for-dependabot-alerts.md +++ b/content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-notifications-for-dependabot-alerts.md @@ -21,31 +21,12 @@ topics: contentType: how-tos --- -## About notifications for {% data variables.product.prodname_dependabot_alerts %} - -When {% data variables.product.prodname_dependabot %} detects vulnerable dependencies in your repositories, we generate a {% data variables.product.prodname_dependabot %} alert and display it on the **Security** tab for the repository. {% data variables.product.github %} notifies the maintainers of affected repositories about the new alert according to their notification preferences.{% ifversion fpt or ghec %} {% data variables.product.prodname_dependabot %} is enabled by default on all public repositories, and needs to be enabled on private repositories. By default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email. You can override the default overall behavior by choosing the type of notifications you want to receive, or switching notifications off altogether in the settings page for your user notifications at [https://github.com/settings/notifications](https://github.com/settings/notifications). -{% endif %} - -{% data reusables.dependabot.no-dependabot-alerts-for-malware %} - -Regardless of your notification preferences, when {% data variables.product.prodname_dependabot %} is first enabled, {% data variables.product.github %} does not send notifications for all vulnerable dependencies found in your repository. Instead, you will receive notifications for new vulnerable dependencies identified after {% data variables.product.prodname_dependabot %} is enabled, if your notification preferences allow it. - -{% ifversion fpt or ghec %}If you're an organization owner, you can enable or disable {% data variables.product.prodname_dependabot_alerts %} for all repositories in your organization with one click. You can also set whether {% data variables.product.prodname_dependabot_alerts %} will be enabled or disabled for newly-created repositories. For more information, see [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization#enabling-or-disabling-a-feature-for-all-new-repositories-when-they-are-added). -{% endif %} - -{% ifversion ghes %} -By default, if your enterprise owner has configured email for notifications on your enterprise, you will receive {% data variables.product.prodname_dependabot_alerts %} by email. - -Enterprise owners can also enable {% data variables.product.prodname_dependabot_alerts %} without notifications. For more information, see [AUTOTITLE](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise). -{% endif %} +By default, {% data variables.product.github %} sends notifications about new alerts by email to people with write, maintain, or admin permissions to a repository. See [AUTOTITLE](/code-security/concepts/supply-chain-security/about-dependabot-alerts#notifications-for-alerts). ## Configuring notifications for {% data variables.product.prodname_dependabot_alerts %} -When a new {% data variables.product.prodname_dependabot %} alert is detected, {% data variables.product.github %} notifies all users with access to {% data variables.product.prodname_dependabot_alerts %} for the repository according to their notification preferences. You will receive alerts if you are watching the repository, have enabled notifications for security alerts or for all the activity on the repository, and are not ignoring the repository. For more information, see [AUTOTITLE](/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications#configuring-your-watch-settings-for-an-individual-repository). - You can configure notification settings for yourself or your organization from the Manage notifications drop-down {% octicon "bell" aria-label="The notifications bell" %} shown at the top of each page. For more information, see [AUTOTITLE](/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications#choosing-your-notification-settings). -{% data reusables.notifications.vulnerable-dependency-notification-delivery-method-customization2 %} {% data reusables.notifications.vulnerable-dependency-notification-options %} {% ifversion update-notification-settings-22 %} @@ -57,12 +38,6 @@ You can configure notification settings for yourself or your organization from t {% data reusables.repositories.security-alerts-x-github-severity %} For more information, see [AUTOTITLE](/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications#filtering-email-notifications). -## How to reduce the noise from notifications for {% data variables.product.prodname_dependabot_alerts %} - -If you are concerned about receiving too many notifications for {% data variables.product.prodname_dependabot_alerts %}, we recommend leveraging {% data variables.dependabot.auto_triage_rules %} to auto-dismiss low-risk alerts. Rules are applied before alert notifications are sent, so alerts that are auto-dismissed upon creation do not send notifications. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-auto-triage-rules/about-dependabot-auto-triage-rules). - -Alternatively, you can opt into the weekly email digest, or even completely turn off notifications while keeping {% data variables.product.prodname_dependabot_alerts %} enabled. You can still navigate to see your {% data variables.product.prodname_dependabot_alerts %} in your repository's **Security** tab. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts). - ## Further reading * [AUTOTITLE](/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications) diff --git a/content/code-security/reference/secret-security/supported-secret-scanning-patterns.md b/content/code-security/reference/secret-security/supported-secret-scanning-patterns.md index acac7d6f538b..286920ddaafb 100644 --- a/content/code-security/reference/secret-security/supported-secret-scanning-patterns.md +++ b/content/code-security/reference/secret-security/supported-secret-scanning-patterns.md @@ -47,6 +47,7 @@ The tables list the secrets supported by {% data variables.product.prodname_secr * Includes {% ifversion secret-scanning-alert-experimental-list %}default{% else %}high confidence{% endif %} tokens, which relate to supported patterns and specified custom patterns, as well as non-provider tokens such as private keys, which often result in false positives.{% endif %} * **Push protection:** Token for which leaks are reported to users on {% data variables.product.prodname_dotcom %}. Applies to repositories with {% data variables.product.prodname_secret_scanning %} and push protection enabled. * **Validity check:** Token for which a validity check is implemented. {% ifversion secret-scanning-validity-check-partner-patterns %}For partner tokens, {% data variables.product.prodname_dotcom %} sends the token to the relevant partner. Note that not all partners are based in the United States. For more information, see [{% data variables.product.prodname_AS %}](/free-pro-team@latest/site-policy/github-terms/github-terms-for-additional-products-and-features#advanced-security) in the Site Policy documentation.{% else %} Currently only applies to {% data variables.product.prodname_dotcom %} tokens.{% endif %} +* **Metadata check:** Token for which extended metadata is available, providing additional context about the detected secret. * **Base64:** Token for which Base64-encoded versions are supported. ### Non-provider patterns @@ -117,12 +118,12 @@ Precision levels are estimated based on the pattern type's typical false positiv {% ifversion fpt or ghec %} > [!NOTE] -> Validity checks are only available to users with {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} who enable the feature as part of {% data variables.product.prodname_GH_secret_protection %}. +> Validity and extended metadata checks are only available to users with {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} who enable the feature as part of {% data variables.product.prodname_GH_secret_protection %}. -| Provider | Token | Partner | User | Push protection | Validity check | Base64 | -|----|:----|:----:|:----:|:----:|:----:|:----:| +| Provider | Token | Partner | User | Push protection | Validity check | Metadata check | Base64 | +|----|:----|:----:|:----:|:----:|:----:|:----:|:----:| {%- for entry in secretScanningData %} -| {{ entry.provider }} | {{ entry.secretType }} | {% if entry.isPublic %}✓{% else %}✗{% endif %} | {% if entry.isPrivateWithGhas %}✓{% else %}✗{% endif %} | {% if entry.hasPushProtection %}✓{% else %}✗{% endif %} | {% if entry.hasValidityCheck %}✓{% else %}✗{% endif %} | {% if entry.base64Supported %}✓{% else %}✗{% endif %} | +| {{ entry.provider }} | {{ entry.secretType }} | {% if entry.isPublic %}✓{% else %}✗{% endif %} | {% if entry.isPrivateWithGhas %}✓{% else %}✗{% endif %} | {% if entry.hasPushProtection %}✓{% else %}✗{% endif %} | {% if entry.hasValidityCheck %}✓{% else %}✗{% endif %} | {% if entry.hasExtendedMetadata %}✓{% else %}✗{% endif %} | {% if entry.base64Supported %}✓{% else %}✗{% endif %} | {%- endfor %} {% endif %} diff --git a/data/reusables/notifications/vulnerable-dependency-notification-options.md b/data/reusables/notifications/vulnerable-dependency-notification-options.md index b70c6fdb95c5..600c79642096 100644 --- a/data/reusables/notifications/vulnerable-dependency-notification-options.md +++ b/data/reusables/notifications/vulnerable-dependency-notification-options.md @@ -1,4 +1,4 @@ -{% ifversion fpt or ghec %}By default, you will receive notifications:{% endif %}{% ifversion ghes %}By default, if your enterprise owner has configured email for notifications on your instance, you will receive {% data variables.product.prodname_dependabot_alerts %}:{% endif %} +You can choose to receive notifications: * In your inbox, as web notifications. A web notification is sent when {% data variables.product.prodname_dependabot %} is enabled for a repository, when a new manifest file is committed to the repository, and when a new vulnerability with a critical or high severity is found (**On {% data variables.product.prodname_dotcom %}** option). * By email. An email is sent when {% data variables.product.prodname_dependabot %} is enabled for a repository, when a new manifest file is committed to the repository, and when a new vulnerability with a critical or high severity is found (**Email** option). diff --git a/src/secret-scanning/data/public-docs-schema.ts b/src/secret-scanning/data/public-docs-schema.ts index 5820116614b3..4d770ddcbb97 100644 --- a/src/secret-scanning/data/public-docs-schema.ts +++ b/src/secret-scanning/data/public-docs-schema.ts @@ -19,7 +19,7 @@ export interface SecretScanningEntry { isPrivateWithGhas: boolean | string hasPushProtection: boolean | string hasValidityCheck: boolean | string - hasExtendedMetadata?: boolean | string + hasExtendedMetadata: boolean | string base64Supported: boolean | string isduplicate: boolean } @@ -37,6 +37,7 @@ export default { 'isPrivateWithGhas', 'hasPushProtection', 'hasValidityCheck', + 'hasExtendedMetadata', ], properties: { provider: { diff --git a/src/types/types.ts b/src/types/types.ts index e38defed7c5a..4fb53e8fb92b 100644 --- a/src/types/types.ts +++ b/src/types/types.ts @@ -327,6 +327,7 @@ export type SecretScanningData = { isPrivateWithGhas: boolean hasPushProtection: boolean hasValidityCheck: boolean | string + hasExtendedMetadata: boolean ismultipart?: boolean base64Supported: boolean isduplicate: boolean