GitHub security and compliance
Interpret captured alert counts, organization controls, and repository coverage before using them in a review.
Open Workspace > Integrations and select the connected GitHub account. You need workspace Admin or Owner access and the Platform feature. Choose Security for alerts and Compliance for control coverage.
Check each section's capture status and capture time first. These views summarize the evidence Sorena collected; they do not perform a complete live security scan or certify compliance. Resolve findings and change controls on GitHub, then sync the connection to review a newer capture.
Review security alert counts
In Security, review the following panels together:
| Panel | What the capture describes |
|---|---|
| Dependabot alerts | Open alerts about vulnerable dependencies, grouped by GitHub severity. |
| Code-scanning alerts | Open findings from code analysis, grouped by security severity. |
| Open secret-scanning alerts | Open alerts about detected credentials. Secret values are not displayed. |
| Open repository advisories | Open repository security advisories, which record security issues. |
| Licensed repositories | Repositories with a resolved software license, alongside the count without one. |
| Pending dismissals | Requests awaiting review outside this view. |
Compare the severity groups as well as the total. Unavailable can mean that Sorena lacks the severity evidence needed for a complete total; it does not mean zero alerts. Secret categories shows types of detected credentials and their open counts. A confirmed empty category list differs from a message saying categories were not captured.
For the history behind alert changes or requests, open Activity > Security alerts or Dismissal requests. A pending dismissal is a request to dismiss an alert, not proof that the issue was fixed or the request approved.
Review organization security controls
In Compliance, check Organization controls:
- Two-factor authentication requirement records whether members must use a second check when signing in. An organization-wide requirement is separate from the captured state of individual members.
- Actions SHA pinning records whether GitHub Actions must reference fixed commit identifiers. SHA pinning keeps the selected action tied to a particular version of its code.
Read Required, Not required, or the unavailable state as observed evidence. Sorena does not offer switches here to change these requirements.
Review repository protection coverage
Branch protection compares covered default branches with the total sampled in the capture. Read the count with the percentage. An unavailable percentage means the view cannot provide a confirmed coverage ratio.
Enforcing rulesets counts active rule collections that enforce their requirements. Evaluate-only rulesets counts rules being evaluated without enforcement. Review these separately; evaluation does not establish that a rule was enforced.
The remaining cards show outside collaborators, repository licenses, and pending Dependabot, code-scanning, and secret-scanning dismissal requests. These help identify follow-up work; a count alone does not establish whether your organization's obligations are met.
If the capture is partial, permission-limited, stale, or unavailable, check GitHub connection permissions and request a sync when appropriate. Use the section's retry action for a loading failure. Review governance evidence for repository review requirements and policy files before recording your findings.
Screenshots show a demo workspace.