Originally reported by newkerala.com. Original announcement dated June 2019.
Overview
WhiteSource, a provider of open source security and license compliance management tooling, announced a data partnership with GitHub in June 2019. The goal: broaden the coverage of GitHub’s built-in security vulnerability alerts by integrating WhiteSource’s aggregated vulnerability intelligence into GitHub’s dependency scanning features.
Background: GitHub Security Alerts
GitHub introduced security alerts in late 2017. The feature notifies repository owners when their project depends on a package with a known vulnerability, and where possible, suggests a remediated version. At the time of the WhiteSource announcement, GitHub’s security alerts covered the following ecosystems:
- JavaScript (npm)
- Ruby (RubyGems)
- Java (Maven)
- .NET (NuGet)
- Python (PyPI)
The alerts applied to both public and private repositories, giving teams visibility into vulnerable transitive and direct dependencies without leaving the platform.
What the WhiteSource Partnership Added
GitHub’s native vulnerability data was primarily sourced from the National Vulnerability Database (NVD). While comprehensive, the NVD can lag behind public disclosure of vulnerabilities in actively maintained open source projects. WhiteSource supplemented this by aggregating vulnerability intelligence from multiple sources:
- National Vulnerability Database (NVD) — the industry-standard CVE repository maintained by NIST
- Security advisories — vendor and community advisories that may precede NVD publication
- Open source project issue trackers — bug reports and security disclosures filed directly in upstream repositories, which are sometimes never formally assigned a CVE
By combining these sources, the partnership aimed to surface vulnerabilities earlier and more completely than either party could achieve independently.
Why This Matters for DevOps Teams
Modern applications routinely pull in dozens or hundreds of open source dependencies, each of which can introduce transitive dependencies of their own. Manually tracking the security posture of this dependency graph is impractical at scale. Integrating vulnerability alerts directly into the developer workflow — at the repository level, before code ships — shifts security left without requiring developers to adopt separate tooling.
GitHub reported sending nearly 27 million security vulnerability alerts to users in the year leading up to this announcement, illustrating the scale at which automated dependency scanning was already operating across the platform.
Quotes From Both Parties
Together we will continue to empower developers to harness the power of open source without compromising on security or agility by simplifying the process of finding and fixing open source vulnerabilities.
Rami Sass, CEO, WhiteSource
Through our data partnership with WhiteSource, we’ll be able to further enhance our security vulnerability alerts, providing our customers with the continued security features they need to build secure software.
Shanku Niyogi, Senior Vice President of Product, GitHub
Context: WhiteSource and GitHub in 2023 and Beyond
This article documents the state of the partnership as announced in June 2019. Since then, both products have evolved significantly. WhiteSource was rebranded as Mend in 2022. GitHub has expanded its security capabilities substantially through the GitHub Advanced Security suite, which includes CodeQL-based code scanning, secret scanning, and Dependabot for automated dependency updates. Readers implementing open source security tooling today should consult the current documentation for both Mend and GitHub Advanced Security to understand the present integration landscape.