Question

A security team lead at a large enterprise wants to organize remediation of 400 high-severity SQL injection code scanning alerts spread across 30 repositories. She creates a security campaign with a specific set of these alerts, sets a due date, and assigns the campaign manager role. The developers who own the affected repositories need to understand what to fix, discuss the alerts, and track progress toward the deadline. Which built-in capability of security campaigns directly supports this goal?

Accepted Answer

Campaigns notify affected repository contributors and provide a shared view with progress tracking, remediation guidance, and per-alert collaboration so developers can work toward the deadline.

Answer

Campaigns automatically generate Dependabot pull requests that patch each alert and merge them once CI passes.

Answer

Campaigns permanently dismiss all included alerts at the due date if they remain open, closing the backlog automatically.

Answer

Campaigns convert each alert into a branch protection rule that blocks all merges to the default branch until the alert is resolved.