Repository navigation
[TSC]: Evaluate Socket Security over Dependabot #153
Description
Have you used AI?
No
Description
We should discuss if we should use socket security in replacement for dependabot across the organization.
Misc
Will need to replace the dependabot workflows with the socket-security ones.
Reacted by Copilot
Activity
ovflowd commentedon Aug 23, 2026
@evenstensberg replacement for what, for Security Alerts? I feel that Dependabot/GitHub Security Tab is pretty sufficient nowadays. The security team is constantly adding features to the "Advanced Security" tab on repository settings. But I agree that Socket's own database probably gets updated much faster on 0-days? (Assuming that their data gets public before a GHSA gets created?)
Just thinking out loud what we don't get from each other.
evenstensberg commentedon Aug 23, 2026
Its not only the data reporting, socket has a intuitive UI when it comments on issues and creates Pull Requests. The funnel UI in particular is very useful.
ovflowd commentedon Aug 23, 2026
Noted. Also Copilot failed miserable on doing my ask lol
evenstensberg commentedon Sep 7, 2026
TSC decision -> we use both!