# Dependency security

> Opt into weekly vulnerability checks, review findings, and choose whether Darting starts billable fix work.

Dependency security checks the default branch for known **high and critical vulnerabilities**. Audits are off by default and do not start fix work unless you separately enable automatic fixes.

## Enable audits

A team manager can open **Project Settings → Dependency security** and turn on **Dependency audit**. This opts the repository into the next weekly scan. Repositories stored by Darting are not scanned.

With auditing enabled, **Run check now** starts an on-demand check. The button is unavailable while a check is running or during the cooldown; the panel shows when another check is available.

## Read the findings

The panel shows the last successful check and groups findings by package, with affected versions, file paths, and advisory links. A successful check with no findings says **No high or critical vulnerabilities found**. This is not a guarantee that the project has no security issues: the check covers known dependency advisories at those severities.

A failed check shows its error rather than reporting a clean result. If the check status cannot be loaded, use **Retry**.

## Choose whether to fix automatically

**Fix vulnerable dependencies automatically** is a separate, **billable opt-in**, available only after auditing is enabled. Turning it on can start a Dependency Doctor thread for saved findings and for new findings from later weekly scans. Auditing alone never starts that work.

When a Dependency Doctor is running, **View thread** opens its conversation so you can inspect the proposed changes and progress. Fix work follows the project's [billing rules and limits](https://darting.dev/docs/usage-and-limits/).