> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/get-started/bring-in-findings/code-scanners/github-dependabot.md).

# GitHub Dependabot

Import GitHub Dependabot alerts into Konvu for exploitability analysis.

The Dependabot integration imports dependency vulnerability alerts from GitHub Dependabot into Konvu. Dependabot alerts flow through your GitHub App connection -- there is no separate scanner credential to configure.

## What this integration brings in

* Vulnerability identifiers (CVE/GHSA) from the GitHub Advisory Database
* Affected dependency name, version, and ecosystem
* Manifest locations from your repository's dependency files
* Alert state (open, dismissed, fixed)

## Prerequisites

* A GitHub organization connected to Konvu via the GitHub App (see [GitHub Installation](/konvu/get-started/connect-your-environment/source-code/managed-analysis/github-installation.md))
* Dependabot alerts enabled on your target repositories
* GitHub App permissions: `vulnerability_alerts: read` to fetch alerts, `vulnerability_alerts: write` to dismiss alerts from Konvu

{% hint style="warning" %}
**Required permissions**: Your GitHub App needs `vulnerability_alerts: read` permission to fetch Dependabot alerts. Add `vulnerability_alerts: write` if you want to dismiss alerts directly from Konvu. See [Connecting GitHub](/konvu/get-started/connect-your-environment/source-code/self-hosted-analysis/connecting-github.md) for details.
{% endhint %}

## Setup steps

Dependabot alerts are imported automatically when you connect a GitHub organization that has Dependabot enabled. If you have already connected GitHub for source code analysis, enable Dependabot alert import:

1. Go to [**Integrations**](https://app.konvu.com/integrations) in Konvu.
2. Select your GitHub integration.
3. Ensure **Import SCA issues** is enabled for the integration.

If Dependabot is not yet enabled on your repositories, follow these steps in GitHub:

1. Navigate to the target repository on GitHub.
2. Go to **Settings**.
3. In the **Security** section of the sidebar, click **Advanced Security**.
4. Next to **Dependabot alerts**, click **Enable**.

Once enabled, Dependabot alerts sync into Konvu on the next integration sync.

## Verify findings are flowing

After enabling, confirm the integration is working:

1. Go to **Integrations** in Konvu and check that your GitHub integration shows a successful sync.
2. Click the integration to see repositories -- those with Dependabot enabled should show finding counts.
3. Navigate to the **Triage** page -- Dependabot findings appear with a GitHub Dependabot source label.

If findings are not appearing, check that:

* Dependabot alerts are enabled on the target repositories in GitHub
* The GitHub App has `vulnerability_alerts: read` permission
* The **Import SCA issues** toggle is enabled for the integration in Konvu

## Next steps

* [Connect your environment](/konvu/get-started/connect-your-environment.md) to give Konvu source code context for exploitability analysis
* [Triage findings](/konvu/triage-and-remediation/exploitability-assessment.md) to review Konvu's AI-driven assessments on your Dependabot findings


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.konvu.com/konvu/get-started/bring-in-findings/code-scanners/github-dependabot.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.