GitHub Has a Secret Security API — Scan Any Repo for Vulnerabilities in 30 Seconds

Most developers use GitHub for code. Almost nobody knows it has a free security scanning API that checks your dependencies for known vulnerabilities — in real time. I discovered this while investigating a production incident at 2 AM. A dependency we'd been using for 18 months had a critical RCE vulnerability. GitHub's API had flagged it 4 months ago . We just never checked. Here's how to never make that mistake again. The API Nobody Talks About GitHub's Advisory Database API gives you access to the same vulnerability data that powers Dependabot alerts — but programmatically. import requests def check_repo_vulnerabilities ( owner , repo , token ): """ Query GitHub ' s GraphQL API for security vulnerabilities in a repository ' s dependency graph. """ query = """ query($owner: String!, $repo: String!) { repository(owner: $owner, name: $repo) { vulnerabilityAlerts(first: 100) { nodes { securityAdvisory { summary severity publishedAt references { url } } vulnerableManifestPath dismissReason