Question

You are the security admin for an organization on GitHub Enterprise Cloud with GitHub Advanced Security enabled. A newly formed application security team needs to view and triage Dependabot alerts across all repositories in the organization, but company policy states they must NOT be granted write/push access to code and must NOT be organization owners. Developers on individual teams should continue to see alerts only for their own repositories. What is the most appropriate way to grant the appsec team the access they need?

Accepted Answer

Grant the appsec team the organization-level 'security manager' role, which provides read access to all repositories and the ability to view and manage security alerts without granting write access to code.

Answer

Add the appsec team as Admin on every repository so they can view Dependabot alerts, since alert access is only available to repository admins.

Answer

Make each appsec team member an organization Owner so they inherit full visibility into all security alerts across the organization.

Answer

Grant the appsec team Write access on all repositories, because Dependabot alert triage requires the ability to open fix pull requests.