Security
Dependabot
Automated dependency updates that keep sites patched against known vulnerabilities.
Dependabot is GitHub's automated dependency-security tool. It watches the open-source packages a site is built on, flags any with known security vulnerabilities, and opens ready-made update requests to fix them. HDC uses Dependabot on the code behind client sites so that when a vulnerability is discovered in a dependency, we know quickly and can patch it, keeping the sites we build and maintain secure over time, not just on launch day.
Where it shines
- Automatically alerts us when a dependency has a known security vulnerability
- Opens ready-to-review update requests, so patching is fast and low-risk
- Keeps sites secure over their whole life, not just at launch
- Built into GitHub, where our code already lives, no extra service to run
- Reduces the chance of a known, preventable exploit slipping through
- Creates a clear, auditable trail of what was updated and when
Trade-offs to weigh
- Updates still need a human to review and test before they go live
- Only covers known, published vulnerabilities, not brand-new unknown ones
- Can be noisy on large projects without sensible configuration
What Dependabot is
Dependabot is GitHub’s automated dependency-security tool. Modern websites aren’t written entirely from scratch, they’re built partly from open-source packages, the tested building blocks that handle common jobs. Those packages occasionally turn out to contain security vulnerabilities, and when a fix is released, every site still using the old version needs updating. Dependabot automates the watching and the flagging of exactly that.
It continuously checks a project’s dependencies against databases of known vulnerabilities. When it finds one, it raises an alert and opens a ready-made request to bump the package to a safe version, complete with the details of what changed. It turns “keeping up with security patches”, a tedious, easily-forgotten chore, into something systematic.
How HDC uses Dependabot
We run Dependabot on the code behind the sites we build and maintain, as part of keeping them healthy:
- We get early warning when a dependency a client’s site relies on develops a known vulnerability.
- We review and test the prepared update before it goes live, so a security fix never breaks the site.
- We patch promptly and deliberately, closing known holes long before they could be exploited.
- We keep an auditable trail of what was updated and when, part of maintaining a site responsibly over time.
Why we apply it
A very large share of real-world security incidents trace back to known, already-patched vulnerabilities in out-of-date components, problems that were entirely avoidable if someone had updated in time. On a busy schedule, those updates are easy to miss, which is exactly how preventable issues become live risks.
Dependabot removes that excuse. It surfaces the problem the moment it’s relevant and drafts the fix, so staying patched becomes routine rather than something that depends on remembering. For a client, it means the site they launched stays secure as the world around it changes, without them having to think about it.
How Dependabot fits our stack
Dependabot lives inside GitHub, where the code for the sites we build already sits, and it leans on Git version control to make every update safe, reviewable and reversible. It complements the protection at the edge, Cloudflare and Turnstile guard the running site and its forms, while Dependabot guards the code and components underneath. Together they cover a site from the browser down to its dependencies.
When Dependabot isn’t enough on its own
Dependabot handles one important slice of security, known vulnerabilities in dependencies, but it isn’t the whole picture. It can’t catch brand-new, undisclosed flaws, and its updates still need a human to review and test so nothing breaks. It sits alongside other practices, secure coding, edge protection, sensible access control, rather than replacing them. As the tool that keeps the building blocks of a site patched, though, it’s a quiet, high-value part of maintaining anything we build.
Worked example
Patched before it becomes a problem
Picture a client site that's been happily live for a year. One of the open-source packages it relies on quietly turns out to have a security flaw, the kind of thing that, left alone, an attacker could eventually exploit. Because Dependabot is watching the code, it flags the issue and opens an update almost as soon as the fix is published. We review and test it, then roll it out, so the site is patched long before the flaw could ever be used against it. The client never has to think about it; it's just part of keeping their site healthy. (Illustrative, every maintenance setup is scoped to the engagement.)
Better together
How Dependabot fits with the rest of our stack
Dependabot: your questions answered
What is Dependabot?
Dependabot is a security tool built into GitHub. Modern websites are assembled partly from open- source building blocks (dependencies), and those occasionally turn out to have security flaws. Dependabot keeps an eye on them, alerts when one has a known vulnerability, and opens a ready-made request to update it to a safe version.
How does Dependabot keep my site secure?
It watches the packages your site is built on and cross-checks them against databases of known vulnerabilities. When a problem is found, it tells us and prepares the fix as an update we can review and test. That means security patches happen promptly and deliberately, rather than a known flaw sitting unnoticed in your site for months.
Does this mean my site is patched automatically without anyone checking?
No, and that's by design. Dependabot prepares the updates, but a person on our team reviews and tests each one before it goes live, so a fix never breaks your site. It removes the hard part, spotting the issue and drafting the change, while keeping a human firmly in control of what actually ships.
Is keeping dependencies updated really that important?
Yes. A large share of real-world security incidents come from known, already-fixed vulnerabilities in out-of-date components, problems that were entirely preventable. Staying patched closes that door. It's one of the least glamorous but most effective things you can do to keep a site safe over time.
Why does HDC use Dependabot?
Because security isn't a launch-day checkbox, it's ongoing. Dependabot gives us early warning when a dependency behind a client's site develops a known vulnerability, and a fast, safe way to patch it. That's how we keep the sites we build and maintain secure over their whole life, quietly, before problems can become incidents.
Want Dependabot working for your business?
Tell us what you're trying to achieve, we'll show you, honestly, whether it's the right tool and how we'd apply it.
What are you looking for?