Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Security monitoring add-on

← All articles

Optional alerts for supported public package coordinates across branches. Coverage and failures are visible to your team. Findings never appear on public pages.

Monitoring requires both the selected add-on and subscription access. It continues during an overdue payment and through the remaining paid period after cancellation. Paused or expired subscriptions and cancellation after that period stop scans, findings and alerts. Open Security screens and settings also lock when the remaining period ends. The selection stays saved for a future subscription; a billing manager can disable it under Billing → Add-ons, including after expiry. Resolve an overdue payment before disabling it.

Security monitoring compares supported public package coordinates across all current branches against OSV (Open Source Vulnerabilities) advisory data. Public registry packages are eligible, as are exact Maven and NuGet coordinates with no recorded source origin or source binding. This is an advisory comparison, not proof that an installed artifact came from that registry. Findings appear on each project's Security tab and in email alerts to your team. This is a paid org-wide add-on ($200/month or $2000/year).

Coverage and failed checks

NuGet package names are matched using the canonical ID and exact normalized version from the public nuget.org manifest before advisory lookup. If that identity cannot be confirmed, the branch check fails and retains prior findings, severity and acknowledgements. A later successful check can resolve a finding for a package that was actually removed.

Swift, Bun packages with an omitted default-registry origin, ambiguous npm identities, explicit git/path/URL or private sources, and SBOM packages outside the supported public-coordinate rules are excluded. These excluded packages do not produce security findings, banners or emails. Organization-wide pricing does not imply every imported dependency is covered.

Security shows each current branch separately, with checked, total and skipped package counts. A failed attempt has its own date; older findings remain visible and may be stale. A new inventory or an older scan without counts has unknown coverage. Zero or partial coverage cannot produce the clean shield, and one successful branch cannot conceal another branch's failure. Select Scan now to retry. Use Show more findings to continue through the result pages.

When scans run

  • On a daily schedule while monitoring is enabled, including inventories that are not published.
  • Immediately after a repo sync (GitHub, GitLab, or Azure DevOps), manual import, or publish when dependencies change.
Findings stay inside the authenticated app. They are never shown on public attestation pages. Enable from Billing when your subscription is active.

Notification recipients

Vulnerability alerts go to the project's leads when any are set. Otherwise they go to the organization's shared notification-recipient list, managed in Settings → Security (the same fallback used for dependency-change digests). Integration and custom-domain alerts still use the organization list. If that list is empty, SourceTrust falls back to organization owners and admins. See Help center → Project leads (Project leads) and Dependency change digests (Dependency change digests).