probo/controls/code/COD.003.dependancy_vulnerability_alerts.md

id, category, revision-version, revision-date, estimate-time, frameworks

id	category	revision-version	revision-date	estimate-time	frameworks
COD-003	code	1	2024-01-07	15m	name sections soc2 CC4.1 CC8.1

Purpose

It ensures your project stays secure and up-to-date without manual tracking of dependencies. It also reduces the risk of using outdated or insecure libraries in your codebase.

Implementation

Github

1. Go to your repository on GitHub.
2. Click on the "Settings" tab.
3. On the left sidebar, click "Security & analysis".
4. Under "Dependabot alerts", ensure "Dependency graph" and "Dependabot security updates" are enabled.
5. GitHub will now alert you to any vulnerable dependencies and automatically open pull requests to fix them.

Evidence

• Screenshot of Dependabot configuration screen
• Sample of dependency update PRs
• Vulnerability alert history