---
name: GitHub Dependabot
slug: github-dependabot
url: https://docs.github.com/en/code-security/getting-started/github-security-features
category: Dependencies
bestFor: "Alerts and pull requests when a dependency you already use has a known vulnerability."
freeTier: yes
price: "Included on GitHub"
checks: []
freeTierNote: "GitHub's security features page lists Dependabot alerts, security updates, version updates, and malware alerts under features available regardless of plan, without purchasing GitHub Code Security. The same page says most of those features are available for public and private repositories, and that some features are public-only. It also says custom auto-triage rules and dependency review are part of GitHub Code Security, with dependency review available for public repositories by default."
verifiedOn: "2026-10-13"
sources:
  - https://docs.github.com/en/code-security/getting-started/github-security-features
unknowns:
  - "The overview page does not spell out a numeric alert quota for private repositories on the free GitHub plan."
---

Dependabot is the lowest-friction way to hear about known-bad versions if you already use GitHub. Enable alerts and security updates, and read the advisory before you merge a major bump.

It watches published vulnerabilities in dependencies. It does not review the authorization in code you wrote.