GitHub Advanced Security Integration with DefectDojo

GitHub Advanced Security Integration with DefectDojo

GitHub Advanced Security (GHAS) is the set of application security features built into GitHub, the code hosting platform owned by Microsoft. It covers three alert families: Dependabot alerts for vulnerable open source dependencies, code scanning alerts from CodeQL or third-party SARIF uploads, and secret scanning alerts for credentials committed to repositories. Since April 2025 GitHub sells the paid features as GitHub Secret Protection and GitHub Code Security, while Dependabot alerts are available on every repository. Alerts are exposed through GitHub's REST and GraphQL APIs as JSON, which DefectDojo can import as files or pull with a DefectDojo Pro connector.

GitHub Advanced Security Integration with DefectDojo

Our code lives in GitHub, so GitHub Advanced Security is the first scanner that sees every pull request. The trouble is that its alerts live per repository. With 200 repositories, nobody can answer "how many Critical dependency vulnerabilities do we have open, and which team owns them?" from the Security tab. Sending GitHub Advanced Security alerts to DefectDojo puts Dependabot, code scanning, and secret scanning results on the Asset that owns each repository, next to findings from our DAST and container tools, with SLAs and owners attached.

Why GitHub Advanced Security Matters

GitHub Advanced Security runs where developers already work, which makes it one of the cheapest ways to get coverage across a large code base.

• Dependabot alerts match manifests and lockfiles against the GitHub Advisory Database and often come with an automatic fix pull request.
• Code scanning with CodeQL traces data flow through source code, so it finds injection and similar flaws at the line where they occur.
• Secret scanning catches committed credentials and reports whether GitHub thinks a secret is still valid or has leaked publicly.
• Alerts are scoped to one repository at a time. Cross-repository reporting, SLA tracking, and correlation with non-GitHub scanners need something else.

Advantages of This Integration

What we gained by routing GitHub Advanced Security alerts through DefectDojo:

• Organization-wide view. Alerts from every repository roll up by Asset and Organization, so security leads can report open Critical and High findings by team instead of by repository.
• Deduplication. Dependabot findings are hashed on title, severity, component name, vulnerability IDs, and file path, so re-pulling alerts does not duplicate them. Code scanning findings match on the GitHub alert number first.
• State carried over. Dependabot alerts marked FIXED or DISMISSED in GitHub arrive inactive and mitigated, and code scanning alerts that are not open arrive inactive.
• Exploit context. Dependabot findings keep CVSS v3 scores and vectors, EPSS score and percentile, and a fix-available flag, which helps decide what to patch first.
• SLAs and tickets. GitHub severities map onto DefectDojo's scale, so SLA rules apply, and findings can be assigned or pushed to Jira like anything else.
• Automatic sync in DefectDojo Pro. The GitHub Advanced Security connector discovers repositories and imports all three alert families on a schedule.

How This Integration Works

DefectDojo has three file scan types for GitHub alerts, plus a connector in DefectDojo Pro.

Dependabot alerts: Github Vulnerability Scan. This parser reads a GraphQL response containing a vulnerabilityAlerts node (the RepositoryVulnerabilityAlert object). The DefectDojo docs include a ready-made query and a Python script that pages through all alerts. Requesting number and the repository url lets the parser build a link to each alert. The docs query contains an AFTER placeholder for the pagination cursor, so replace it with null for a single page (or use the script for many). Saved as a file, the query can be run with the GitHub CLI:

gh api graphql -F query=@dependabot-alerts.graphql -F owner=acme -F name=payments-api > dependabot.json

The same scan type also accepts a JSON list of code scanning alerts, but the dedicated SAST scan type below maps them more completely.

Code scanning alerts: Github SAST Scan. Export alerts from the code scanning REST API as a JSON list:

gh api "/repos/acme/payments-api/code-scanning/alerts?state=open&per_page=100" > code-scanning.json

Secret scanning alerts: Github Secrets Detection Report Scan. Export from the secret scanning REST API in the same way, using /repos/OWNER/REPO/secret-scanning/alerts.

For repositories with more than 100 alerts, merge the pages into one JSON array before import.

Import the file. In the UI, open the Engagement, choose Import Scan Results, pick the scan type, and upload the file. To automate, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Github Vulnerability Scan" \
  -F "file=@dependabot.json" \
  -F "product_name=payments-api" \
  -F "engagement_name=GitHub Alerts" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Github SAST Scan" \
  --report-path "./code-scanning.json" \
  --product-name "payments-api" \
  --engagement-name "GitHub Alerts" \
  --auto-create-context

Connector (DefectDojo Pro). The GitHub Advanced Security connector imports code scanning, Dependabot, and secret scanning alerts as three finding types. Configure it with https://api.github.com (or https://<your-host>/api/v3 for GitHub Enterprise Server) as the Location, the organization login, and a personal access token as the Secret. A fine-grained token needs read-only access to code scanning, Dependabot, and secret scanning alerts; a classic token needs the repo and security_events scopes. DefectDojo creates a Record for every non-archived repository. If an alert family is not enabled on a repository, it is skipped rather than treated as resolved, so turning a feature off does not close findings. The connector can also import GitHub Issues that carry labels you choose, with your own label-to-severity map.

Data Granularity: What Gets Imported

The table covers the Github Vulnerability Scan parser for Dependabot alerts.

The other two scan types differ. Github SAST Scan titles each finding with the rule description and rule ID, takes severity from the rule's security_severity_level (Info if absent), sets file path and line from the most recent instance, and deduplicates on the alert number, falling back to rule ID, severity, file path, and line. Github Secrets Detection Report Scan titles findings "Exposed Secret Detected" plus the secret type, records file path and line of the first location, and sets severity from the alert: Critical for an active, publicly leaked secret, High for an active one, Medium otherwise, and Info once the alert is resolved.

Use Cases

Across a large GitHub organization: A platform team with hundreds of repositories enables the DefectDojo Pro connector. Every repository becomes a Record mapped to its Asset, and leadership gets one report of open dependency, code, and secret findings by team.

Prioritizing dependency upgrades: Dependabot findings carry EPSS and a fix-available flag. Filtering DefectDojo for Critical and High findings with a fix available gives a short list of upgrades worth doing this sprint.

Correlating with other scanners: A team that also runs a second SCA tool sees both tools' findings for the same CVE on one Asset, which makes disagreements between tools visible instead of hidden in two consoles.

Handling leaked credentials: Secret scanning findings for active secrets land as High or Critical with a link back to the GitHub alert, so they get an owner and an SLA clock while the credential is rotated.

Operational Tips

• Use Github SAST Scan, not Github Vulnerability Scan, for code scanning exports. It sets file path, line, and the alert number used for deduplication.
• Include number and the repository url in your Dependabot GraphQL query, or findings will lack a link back to the alert.
• Component version comes from the manifest requirement. Unpinned requirements such as a version range appear as written, so check the lockfile before assuming the installed version.
• Choose whether to query open alerts only. The sample query filters on states: OPEN, but pulling fixed and dismissed alerts too lets DefectDojo record them as mitigated.
• Reimport each repository's export into the same Test, so alerts fixed in GitHub close in DefectDojo. Code scanning alert numbers are only unique within a repository, so if several repositories share one Asset, give each its own Engagement and import with deduplication_on_engagement=true.
• If you are on DefectDojo Pro, set a Minimum Severity on the connector to keep Low alerts out until your team is ready for them.