Question

Your security team wants to automatically dismiss Dependabot alerts for a category of vulnerabilities that leadership has formally accepted as low-risk in your environment. Regulators later require proof that each dismissal was intentional, attributable, and reviewable. Which combination of practices BEST satisfies both the operational goal and the auditability requirement?

Accepted Answer

Configure Dependabot auto-triage rules to dismiss the matching alerts, and rely on the rule definition plus the auto-generated audit log entries as the documented, attributable record of each dismissal.

Answer

Manually dismiss each alert one at a time with a free-text comment, because only human action produces a defensible audit trail.

Answer

Delete the affected dependencies from the dependency graph so the alerts no longer appear, eliminating the need for dismissal records.

Answer

Disable Dependabot alerts entirely for the repositories in scope so the low-risk category is never reported.