Scan GitHub dependencies weekly for new vulnerabilities with severity triage

This template runs a weekly security check on the dependencies in your GitHub repository and reports the vulnerabilities that matter. It is built for founders and engineering teams who want a steady read on their dependency risk without running audits by hand.

What it does

Every week the agent produces a baseline of your dependency security debt. It leads with new serious vulnerabilities, giving each one its CVE, severity, whether an upgrade is available, and whether the package is a direct or transitive dependency. Vulnerabilities that were already open are counted along with how long they have persisted, and issues that have been resolved since the last run are acknowledged.

The agent stays quiet when everything is clean, so a report means there is something to look at. The one exception is a failed audit: if the scan cannot complete, it says so rather than passing over the problem in silence.

How it works

The agent carries a dependency audit procedure that it loads on every run. It performs a shallow fetch of the repository, detects the ecosystem, and runs the matching audit commands for that stack, parsing the JSON output with fallbacks when a command behaves differently than expected.

A CVSS threshold rule decides which findings count as serious, and each vulnerability is sorted into new, still open, or resolved so the report reflects real change week over week.

The scan is scheduled to run once a week, early on Thursday morning, connecting to GitHub to reach your repository.