NewsBite analysis · Programming, Security · Software Release
GitHub Blog
Code scanning adds a mitigated alert dismissal reason
GitHub has added a new dismissal option for code scanning alerts, allowing users to classify vulnerabilities as 'Mitigated.' This option is for instances where a vulnerability exists but is controlled through measures like firewalls or network policies. By distinguishing these from 'Won't fix' alerts, GitHub aims to streamline vulnerability management within its platform, supporting formal risk acceptance processes. This improvement can help teams better adhere to compliance and security standards while using GitHub for version control.
MonitorConfidence: HighImmediate horizon
Published 20 Aug 2026, 15:45 UTC1 min read
Visit original article ↗Lead image — GitHub Blog
Summary
TL;DR
- New 'Mitigated' dismissal reason for code scanning in GitHub
- Allows users to specify when vulnerabilities are controlled externally
- Improves alignment with risk acceptance processes
- Reduces tracking of mitigation decisions outside of GitHub
- Enhances overall security management for developers
Interesting facts
- This update aligns with common risk management practices in software development.
- Users can differentiate between mitigated vulnerabilities and those deemed irreparable.
What changed