Get started with secure releases

Secure releases helps you identify vulnerabilities and signing issues in your repositories and releases, so you can ship software with confidence.

This guide walks you through what secure releases functionality does, how to get set up, and what to review first.

How does this benefit me?

With Secure releases, you can:

Monitor repositories and releases for security vulnerabilities
Identify issues in both your source code and third-party dependencies
Prioritize remediation using severity and context
Detect signing issues that may affect software integrity

Tipp

Once enabled, Software Trust Manager continuously analyzes your repositories and surfaces issues in dashboards and alerts.

Before you begin

To get started, you need:

Software Trust Manager account
Access to your GitHub repositories
Permission to connect GitHub repositories

Step 1: Enable secure releases

Contact your DigiCert account manager to enable Secure releases.

Tipp

By default, this feature is disabled in your account.

Step 2: Connect your GitHub repository

In the Managers (grid icon) menu, select Software Trust.
In the Software Trust menu, go to Secure releases.
Select Get started.
Select Authorize GitHub.
In the DigiCert Software Trust page in GitHub, select Add.
Sign in to your GitHub account.
Select one of the following radio buttons
1. All repositories.
  This applies to all future repositories owned by the resource owner. Also includes public repositories (read-only).
2. Only select repositories
  Select at least one repository. Also includes public repositories (read-only).
Select Install & Authorize.
Copy and save the unique onboarding link.
You will need this link if you abandon onboarding before completion or if the session is interrupted. Without this link, you will have to start the authorization workflow from the beginning again.
Select Continue as DigiCert customer.
Select radio button next to your DigiCert environment.
The URL you select should match the URL you use to sign in to DigiCert ONE.
Select Next.
Select Confirm region selection.
Review and select all the checkboxes regarding compliance and data selection.
Select Sign in to DigiCert ONE.
Conditional: If you have more than one DigiCert ONE account you will be prompted to select your account, then select Continue.
On the GitHub integration completed page, select Go to repositories.

Step 3: Enable Monitoring

Enable CodeQL (Code Query Language) and SBOM (Software Bill of Materials) to increase visibility into security risks identified by Secure Release Monitor.

In the Software Trust menu, go to Secure releases.
Select the Repositories tab.
In the row of the disconnected repository, select Manage Monitoring.
Select Monitoring to enable continuous release security monitoring. After enabling monitoring, you can also configure custom on-demand scans as required.

To learn more, refer to Enable CodeQL and SBOM.

Step 4: Review your GitHub data insights

The Repository dashboard provides a high-level view of your integrated repositories and their current security status. Use this page to quickly understand how many repositories are connected, where vulnerabilities exist, and whether scans or signing issues require attention.

In the Software Trust menu, go to Secure releases.

Review the following fields:

Field	Description	How this helps you
Repositories integrated	The total number of repositories currently integrated with Software Trust Manager.	Confirm integration coverage and understand the scale of repositories being monitored.
Vulnerabilities found	The total number of vulnerabilities identified across all integrated repositories.	Quick indicator of overall security exposure and helps you gauge remediation effort.

To learn more, refer to Review your GitHub data insights.

Step 5: Review your repositories

Use this information to determine whether the vulnerability affects your environment and what action to take.

To review your repositories:

In the Software Trust menu, go to Secure releases.
Select the Repositories tab.
Select the repository name you want to review.

On the General information tab, review the following fields:

Field	Description	How this helps you
Repository name	The name of the repository connected to Software Trust Manager.	Quickly identify which codebase you are reviewing.
Status	Indicates whether the repository is connected, disconnected, deleted, or access has been revoked.	Confirm that STM can still scan the repository and alert you to connection issues that may need attention.
Monitoring	Shows whether the repository is actively scanned every 24 hours or is inactive.	Ensure critical repositories are being monitored regularly for new vulnerabilities.
Created on	The date the repository was added to Software Trust Manager.	Understand how long the repository has been under monitoring.
Description	A short description of the repository provided by the source system.	Context about the purpose of the repository.
Source	Indicates the system the repository is integrated from.	Understand where the repository data is coming from and which access permissions apply.

On the On-demand scans tab, review the following fields:

Field	Description	How this helps you
On-demand scan	The on-demand security scan configured in the GitHub Actions workflow to run scans based on your schedule or conditions.	Identify and track a specific on-demand security scan.
Vulnerabilities	The number of vulnerabilities identified by the on-demand scan.	Identify risks detected by the on-demand scan and prioritize them for review.
Source branch	The Git branch on which the on-demand scan was run.	Trace vulnerabilities back to the originating code branch.
Monitoring status	Indicates whether the on-demand scan monitored all release artifacts.	Ensure that all release artifacts are scanned on demand to identify and prioritize new vulnerabilities.
Scan date	The date on which the on-demand scan was run.	Understand the age of the scan.
Source	Indicates the VCS system on which the on-demand scan runs.	Understand where the on-demand scan data comes from.
Owner	The person who has triggered the on-demand scan in GitHub.	Identify the point of contact for on-demand scan inquiries.

On the Releases tab, review the following fields:

Field	Description	How this helps you
Release name	The name of the release created in GitHub.	Identify and track a specific version of your software.
Release status	Indicates whether the release is active, archived, or otherwise inactive.	Focus on releases that are currently in use or supported.
Tag	The Git tag associated with the release.	Correlate the release to a specific code snapshot.
Vulnerabilities	The number of vulnerabilities identified for this release.	Quickly compare risk across releases and prioritize review.
Source branch	The Git branch from which the release was created.	Trace vulnerabilities back to the originating code branch.
SBOM status	Indicates whether an SBOM (Software Bill of Materials) has been generated and analyzed for the release.	Confirm dependency visibility and supply chain coverage.
Released date	The date the release was published.	Understand the age of the release and assess exposure over time.
Author	The user who created the release.	Identify the point of contact for release inquiries.

To learn more, refer to Review your repositories. .

Step 6: Review security alerts

Security alerts help you focus on specific vulnerabilities.

To view security alerts:

In the Software Trust menu, go to Secure releases.
Select the Security alerts tab.
Select the vulnerability ID you want to review.

Review:

Field	Description	How this helps you
CVE ID	A unique identifier for the vulnerability.	Confirms you are reviewing the correct issue, helps you search external advisories or internal tickets, and serves as the primary reference for tracking and remediation.
Current severity	A qualitative severity rating (for example, Medium).	Provides a quick signal to help you prioritize which vulnerabilities to review first.
Description	A summary of what the vulnerability is and how it can be exploited.	Helps you determine whether your application uses the affected functionality in a way that could be exposed to untrusted input.

Select Show more under Description to review the fields:

Field	Description	How this helps you
CVSS score	A numerical severity score based on the CVSS standard.	Allows more precise comparison across vulnerabilities when prioritizing remediation.
CVSS vector	A breakdown of the factors used to calculate the CVSS score.	Helps you understand why the score is what it is, such as whether user interaction or elevated privileges are required.
Release version affected	The versions of the software that contain the vulnerability.	Helps you determine whether your current version is vulnerable.
Fix version	The version that resolves the vulnerability.	Helps you identify the version to upgrade to. If you are already running this version or later, the vulnerability may not require action.
Impact	Describes how the vulnerability can be exploited and the effect it has on affected systems, including technical details such as attack vectors and outcomes (for example, denial of service through excessive resource consumption).	Helps you understand the real-world risk and potential damage, so you can prioritize remediation based on severity and exposure.
Patches	Lists the software versions or updates where the vulnerability has been fixed, along with guidance on which versions to upgrade to.	Enables you to quickly identify the correct remediation path and ensure affected systems are updated to secure versions.
Workarounds	Provides mitigation steps that reduce risk when an immediate upgrade is not possible, such as configuration changes or input restrictions.	Helps you temporarily protect systems and reduce exploitability while planning or scheduling a full fix.
Resources	Includes supporting materials such as repositories, related vulnerabilities, technical references, or documentation relevant to the issue.	Gives you additional context and technical depth for investigation, validation, or communication with stakeholders.
Evidence	Expand to review: Web references Advisory sources Package / Repository Fix / Patch (commit)	Helps you verify the vulnerability, understand its origin, and support audit, compliance, or incident response efforts.
Web references	Links to security research, public disclosures, or technical write-ups.	Allows you to validate details and gather additional technical context.
Advisory sources	Links to official vulnerability advisories, such as NVD entries.	Helps you confirm severity, remediation guidance, and authoritative details.
Package / Repository	Links to the affected project’s source code or package repository.	Helps you explore the affected codebase and understand where the vulnerability exists.
Weakness	A classification of the underlying software weakness that led to the vulnerability.	Provides high-level context, helps identify patterns across vulnerabilities, and informs longer-term remediation or coding improvements.

Review the Detection timeline.
Displays when the vulnerability was first detected, and every other detection within a specific repository.

To learn more, refer to Review your security alerts. .

In diesem Abschnitt: