Dependency security
Opt into weekly vulnerability checks, review findings, and choose whether Darting starts billable fix work.
Dependency security checks the default branch for known high and critical vulnerabilities. Audits are off by default and do not start fix work unless you separately enable automatic fixes.
Enable audits
A team manager can open Project Settings → Dependency security and turn on Dependency audit. This opts the repository into the next weekly scan. Repositories stored by Darting are not scanned.
With auditing enabled, Run check now starts an on-demand check. The button is unavailable while a check is running or during the cooldown; the panel shows when another check is available.
Read the findings
The panel shows the last successful check and groups findings by package, with affected versions, file paths, and advisory links. A successful check with no findings says No high or critical vulnerabilities found. This is not a guarantee that the project has no security issues: the check covers known dependency advisories at those severities.
A failed check shows its error rather than reporting a clean result. If the check status cannot be loaded, use Retry.
Choose whether to fix automatically
Fix vulnerable dependencies automatically is a separate, billable opt-in, available only after auditing is enabled. Turning it on can start a Dependency Doctor thread for saved findings and for new findings from later weekly scans. Auditing alone never starts that work.
When a Dependency Doctor is running, View thread opens its conversation so you can inspect the proposed changes and progress. Fix work follows the project's billing rules and limits.