A modern application is mostly other people's packages. Each one is code we ship, so a known vulnerability in a dependency is a vulnerability in our product, even if we never wrote a line of it.
GitHub Dependabot scans our repositories' full dependency graph and raises an alert whenever one of two things happens: a new vulnerability is published to the GitHub Advisory Database, or our dependency graph changes — for example, when a commit updates a package or its version. Only advisories GitHub has reviewed trigger an alert.
When a fix exists, Dependabot does not stop at the alert. It automatically opens a pull request that updates the dependency to the minimum version that includes the patch, and links that pull request back to the alert. That pull request goes through the exact same review and CI checks as any other change — there is no special, less-scrutinized path for security fixes.
Dependabot signs its own commits by default, so every automated update carries verified authorship, the same as a human contributor's signed commit.
What this does not mean
Dependabot finds known vulnerabilities in dependencies — ones that have been publicly disclosed and reviewed into the GitHub Advisory Database. It does not review the code we write ourselves, and it cannot find a flaw nobody has reported yet. New vulnerabilities also take time to be discovered and published, so there is always a window between a flaw existing and an advisory covering it. We treat Dependabot as one layer, not a verdict on our overall security posture.