{"meta":{"title":"Prioritizing Dependabot and code scanning alerts using production context","intro":"Focus remediation on real risk by targeting Dependabot and code scanning alerts in artifacts deployed to production, using metadata from external systems and integrations like Dynatrace, JFrog Artifactory, Microsoft Defender for Cloud, or your own CI/CD workflows.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/tutorials","title":"Tutorials"},{"href":"/en/code-security/tutorials/secure-your-organization","title":"Secure your organization"},{"href":"/en/code-security/tutorials/secure-your-organization/prioritize-alerts-in-production-code","title":"Prioritize alerts in production code"}],"documentType":"article"},"body":"# Prioritizing Dependabot and code scanning alerts using production context\n\nFocus remediation on real risk by targeting Dependabot and code scanning alerts in artifacts deployed to production, using metadata from external systems and integrations like Dynatrace, JFrog Artifactory, Microsoft Defender for Cloud, or your own CI/CD workflows.\n\nApplication Security (AppSec) managers are often overwhelmed by a high volume of alerts, many of which may not represent real risk because the affected code never makes it to production. By associating production context with your alerts, you can filter and prioritize vulnerabilities that impact artifacts actually approved for production environments. This enables your team to focus remediation efforts on the vulnerabilities that matter most, reducing noise and improving your security posture.\n\n## 1. Associate artifacts with production context\n\nGitHub's linked artifacts page allows you to provide production context for your company's builds using the REST API or a partner integration. Teams can then use this context to prioritize Dependabot and code scanning alerts. For more information, see [About linked artifacts](/en/code-security/concepts/supply-chain-security/linked-artifacts).\n\nTo provide production context, you should configure your system to:\n\n* Update **storage records** in the linked artifacts page whenever an artifact is promoted to a production-approved package repository.\n* Update **deployment records** when an artifact is deployed to a production environment.\n\nGitHub processes this metadata and uses it to power alert filters, such as `artifact-registry-url` and `artifact-registry` from storage records, and `has:deployment` and `runtime-risk` from deployment records. Runtime risks from deployment records are also visible as properties on individual code scanning and Dependabot alert pages.\n\nFor more information on updating records, see [Uploading storage and deployment data to the linked artifacts page](/en/code-security/how-tos/secure-your-supply-chain/establish-provenance-and-integrity/upload-linked-artifacts).\n\n## 2. Use production context filters\n\nProduction context filters are made available in the ** Security and quality** tab.\n\n* **Dependabot view**: See [Viewing and updating Dependabot alerts](/en/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts#viewing-and-prioritizing-dependabot-alerts).\n* **Code scanning view**: See [Assessing code scanning alerts for your repository](/en/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts).\n* **Security campaign view**: See [Creating and managing security campaigns](/en/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns).\n\nOnce the alert list is displayed, use the `artifact-registry-url` or `artifact-registry` filters in organization views to focus on vulnerabilities affecting artifacts present in production.\n\n* For your own artifact repository that is hosted at `my-registry.example.com`, you would use:\n\n ```text copy\n artifact-registry-url:my-registry.example.com\n ```\n\n* If you use JFrog Artifactory, you can use `artifact-registry` with no further setup in GitHub:\n\n ```text copy\n artifact-registry:jfrog-artifactory\n ```\n\nYou can also use the `has:deployment` and `runtime-risk` filters to focus on vulnerabilites that deployment metadata shows as in deployment or at risk of runtime vulnerabilities. This data is populated automatically if you have connected MDC. For example:\n\n* To focus on alerts in deployed code that is exposed to the internet, you would use:\n\n ```text copy\n has:deployment AND runtime-risk:internet-exposed\n ```\n\nYou can also combine these production context filters with other filters, such as EPSS:\n\n```text copy\nepss > 0.5 AND artifact-registry-url:my-registry.example.com\n```\n\n## 3. Remediate alerts in production code\n\nNow you have identified the alerts that put your production code at risk of exploitation, you need to remediate them as a matter of urgency. Where possible use automation to lower the barrier to remediation.\n\n* **Dependabot alerts:** Use automated pull requests for security fixes. See [Configuring Dependabot security updates](/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/configure-security-updates).\n* **Code scanning alerts:** Create targeted campaigns with Copilot Autofix. See [Creating and managing security campaigns](/en/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns).\n\n## Further reading\n\n* [Prioritizing Dependabot alerts using metrics](/en/code-security/tutorials/manage-security-alerts/prioritizing-dependabot-alerts-using-metrics)"}