I'm in the thick of preparing for an upcoming SOC 2 audit and need to prove we're effectively remediating code vulnerabilities. GitHub Advanced Security (GHAS) surfaces the findings beautifully in the UI, but I need a durable, exportable report of *fixed* vulnerabilities over a specific time period for my evidence package.
I've explored the obvious paths:
* The Security Overview dashboard gives a great snapshot, but I can't filter it to a date range and export a clean list of what was *closed*.
* I can query the REST API (`/orgs/{org}/code-scanning/alerts`) and filter by `state=closed`, but correlating which closures were actual fixes (vs. dismissals) and getting the fix timestamp is proving clunky.
* The CSV export from the UI seems limited to *open* alerts.
Has anyone built a reliable method for this? My ideal report would have:
* Vulnerability CVE/GHSA ID
* Repository
* Date opened
* Date fixed
* Fix commit SHA
* Reason (e.g., "fixed," "patched")
I started piecing together a script using the GraphQL API, which seems more powerful for this. Here's my rough start to fetch closed alerts of a specific severity:
```graphql
query ($org: String!, $state: [CodeScanningAlertState!]) {
organization(login: $org) {
repositories(first: 10) {
nodes {
name
codeScanningAlerts(first: 100, states: $state) {
nodes {
state
fixedAt
createdAt
mostRecentInstance {
commitSha
}
rule {
id
}
}
}
}
}
}
}
```
But I'm hitting pagination limits and the `fixedAt` field is often null. Is there a more direct endpoint or a community script that already solves this? Specifically, how are others pulling a compliant audit trail from GHAS?