GitHub Repository defined in Terraform doesn't have vulnerability alerts enabled misconfiguration de

GitHub Repository defined in Terraform doesn't have vulnerability alerts enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GIT_3
Category - Subcategory	Monitoring - Unintegrated
Provider	OTHER
Severity	LOW
Framework	Terraform

Impact

GitHub has the ability to scan dependencies for vulnerabilities. To enable this, you must also enable it at the owner level as well. By default, this is enabled for public repos but not for private repos.

How to Fix

Resource: github_repository

• Attribute: vulnerability_alerts [source,go]

---

resource "github_repository" "example" { name = "example" description = "Example repository" private = true # or false for public repositories

Enable vulnerability alerts for the repository

• vulnerability_alerts = true

... other configurations ...

If the repository is archived, alerts are disabled, and this configuration will not apply

archived = false

}