Hi everyone, I'm brand new to this whole code security scanning thing and I'm trying to get my head around GitHub's tools. I just enabled Dependabot alerts on a small internal project, and I got my first alert flagged as "critical."
It's a bit overwhelming, to be honest! I understand that "critical" is the highest severity, but I'm not entirely sure what I'm supposed to do next. Could someone help me understand what this actually means in practical terms?
For example, does a critical alert always mean there's an active exploit being used in the wild? Or could it be a severe vulnerability that just hasn't been exploited yet? I'm also curious about the immediate steps. Should I drop everything and fix this right now, or is there a triage process I should follow? My team is small, so we have to be careful with our time.
Also, when I look at the alert details, there's a lot of jargon about CVSS scores and CVE IDs. Is there a simple way to prioritize based on the info GitHub provides, or do I need to research each CVE separately? Any guidance on how you all handle these would be super helpful. I want to be proactive but not panic over every single alert 😅