What happened
GitHub has introduced a new dismissal reason for code scanning alerts: Mitigated.
This option lets users dismiss an alert when a vulnerability is still present in the code but external controls, such as a web application firewall or network measures, help address the risk.
Why it matters
Previously, security teams may have lacked a precise way to record that a vulnerability was not being fixed in code but was handled elsewhere.
The new reason makes alert triage more accurate, helping teams distinguish between false positives, accepted risks, and vulnerabilities actively mitigated by outside safeguards.
Key facts
The code scanning feature now includes a 'Mitigated' alert dismissal reason.
This reason applies when a vulnerability remains in the code but external controls, such as a web application firewall or network protections, mitigate it.
What to watch next
Expect more granular alert management options as GitHub continues refining code scanning workflows.
Teams should update their triage processes to incorporate the 'Mitigated' reason where external controls are in place.