GitHub Dependabot

Record your GitHub Dependabot connection as version control evidence. Automated collection is not available for this provider yet.

Connect with OAuth

Before you start, an administrator of GitHub Dependabot must allow third-party apps:

• As an organization owner, click your profile picture, then select Organizations and choose your organization.
• Click Settings (or open it from the More dropdown).
• Under Third-party Access, click OAuth app policy.
• Next to the Safeguard app, click Review, then click Grant access.

1. On Compliance › Connectors, open GitHub Dependabot, click Connect and choose OAuth.
2. Sign in to GitHub Dependabot and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for repo, read:user, read:org. repo grants full access to repositories, including changes; for read-only access, use the API token method with read-only permissions.
3. You return to Safeguard, and the card shows Verified once the first check succeeds.

Connect with an API token

1. In GitHub Dependabot:

   1. In GitHub, go to Settings › Developer settings › Personal access tokens › Tokens (classic) › Generate new token (classic).
   2. In the Note field, give the token a descriptive name, and set an Expiration.
   3. Select the scopes repo and security_events (required by the Dependabot alerts endpoints for classic tokens).
   4. Click Generate token, then click the copy icon to copy the token.

   Where to find the other values:

   • Account / Org / Workspace (optional): Your organization's login, as in the github.com/<org> URL.

   GitHub Dependabot's public documentation does not cover every step.

   Source: docs.github.com, docs.github.com, docs.github.com, checked 2026-10-07.

2. On Compliance › Connectors, open GitHub Dependabot, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads GitHub Dependabot yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Version Control connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks