Skip to Content
Use casesWeekly security check

A weekly watch for new vulnerabilities in your dependencies

Know about a new advisory before it becomes an incident. A deputy reads public vulnerability sources every week, checks whether your repositories use an affected package, and sends you the findings. It can open an issue or a pull request for the ones that matter.

How it works

  • Trigger. A weekly schedule, for example Monday at 07:00 in your time zone.
  • What the run does. It reads recent entries from public sources such as the GitHub Advisory Database, OSV and NVD, compares them with the dependencies in your repositories, and lists what is affected.
  • Who is contacted. The deputy’s owner gets a heads-up with the findings and links, on Home and in Slack when your admin has connected Slack.
  • What you see. A short report, and optionally an issue or a pull request in GitHub.

Set it up

  1. Connect GitHub with the Personal access token method. See Connect GitHub. The github package already allows api.github.com, which serves the GitHub Advisory Database.
  2. Ask an admin to allow the other public sources you use. On the Network policies page, they add a rule with the action allow for each host, for example api.osv.dev and services.nvd.nist.gov. See Network policy. Add the hosts of the sources you choose.
  3. Create a manifest with the packages claude-code, github and your repo’s toolchain, for example node or go.
  4. Open Deputies, select New deputy, and fill in Name, Description, Manifest and Owner.
  5. In the deputy, select New mission. Paste the prompt below into Prompt, select Dry run, then Activate.
  6. Expand the mission. In the Triggers list, select Schedule.
  7. Set Repeats to weekly, On to Monday, At to 07:00, and pick your Timezone. Or select Advanced and enter 0 7 * * 1 in Cron expression.
  8. Select Create.

What you should see: the schedule in the trigger list with its next run time and an on badge.

Example mission prompt

Check the repository acme/web for newly disclosed vulnerabilities.

1. Read the dependency files and lockfiles to list the packages and
   versions in use.
2. Look up advisories published in the last 7 days for those packages in
   the GitHub Advisory Database and in OSV.
3. For each advisory that affects a version we use, note the package,
   the severity, the fixed version, and a link.
4. For each high or critical finding, open a GitHub issue with the
   details and the fix.
5. Send me a heads-up with the findings sorted by severity. If nothing
   is affected, send a heads-up that says so.

Make it yours

  • Add more repositories to the prompt, or run one deputy per team.
  • Ask for a fix: “Open a pull request that bumps the package to the fixed version.” Pair it with Approval before merge.
  • Run it daily with 0 7 * * *.
Stale PR and issue sweeperCloud cost report