Dependabot Verification

Dependabot bumps versions. XOR verifies they're safe to merge.

Every Dependabot PR gets a structured triage: reachability analysis, exploitability assessment, EPSS/KEV enrichment, and a clear verdict. No manual triage. This runs automatically, no @xor-hardener mention needed.

How it works

Reachability analysis

XOR checks whether your code actually calls the vulnerable function, not just whether the dependency is present. Static analysis via Semgrep and SCALIBR against your repository's call graph. The analysis runs on XOR's read-only mirror, not on your infrastructure.

A typical org with 50 repos sees 200+ Dependabot PRs per month. 70-80% of flagged vulnerabilities are not reachable in the application's actual code paths. Reachability filtering eliminates that noise.

Exploitability scoring

Three public data sources, correlated:

Improved PRs

When the verdict is EXPLOITABLE, XOR opens a new PR superseding the Dependabot PR:

1. Same version bump as Dependabot
2. Regression test covering the vulnerable code path
3. Pinned transitive dependencies if the advisory affects downstream packages
4. Verification evidence: "Exploit reproduced pre-fix, fails post-fix"

Verdict lifecycle

Each Dependabot PR receives one structured comment from XOR, visible to all team members. The comment includes the reachability decision, exploitability metrics, and a recommended action. If your code changes and reachability status changes, mention @xor-hardener re-analyze to run triage again. XOR logs every verdict in your compliance trail for audit purposes.

Economic impact

Costs decrease as verification coverage grows. Each triaged vulnerability adds a regression test, reducing unknowns on future CVEs.