Code and applications

Code & apps checks the software your customers build or deploy for dependencies with known vulnerabilities, for example an outdated lodash, guzzlehttp/guzzle or log4j. Open it from the customer's sidebar (Risk → Code & apps).

Each repository or SBOM is a monitored application. Its components are matched against public vulnerability data (OSV.dev, which includes the GitHub Advisory Database) by the same matcher that checks devices, and rescanned every day.

Two ways in

GitHub Enterprise Server isn't supported: connections are to github.com.

Reading the results

• The list shows each repository or application with its open vulnerabilities by severity and when it was last scanned. Scan now runs a scan immediately.
• Open an application for What to do: one line per package with the installed version, the version to upgrade to and how many vulnerabilities that fixes, most urgent first.
• Below it, every vulnerable dependency links to its advisory and shows whether OSV, Dependabot (with the alert number) or both reported it. A vulnerability reported by both is counted once.

Only pinned versions can be matched. Version ranges from a manifest (^4.17.0) are skipped, which is why lockfiles and SBOMs from build output give the best results.

Findings

Serious vulnerabilities (critical, high or known exploited) also become findings linked to the application, so they flow into assignments, PSA tickets, the action plan and reports. Lower-severity ones stay on the Code & apps and Vulnerabilities pages.

Who sees it

Code data is for your MSP team only. The customer portal never lists repositories, applications, components or Dependabot alerts. Findings follow your normal sharing rules: a finding you share with the customer names the affected application or repository.

Pausing monitoring

Turn Monitor daily off to stop watching a repository or application; its vulnerabilities are resolved. A repository resumes when you turn it back on. An SBOM application resumes when you upload a new SBOM.