Assess your repositories
When reviewing repositories in DigiCert® Software Trust Manager, use the repository and release details to understand monitoring coverage, release activity, and where vulnerabilities or configuration issues may require attention.
To assess a repository
In the Software Trust menu, go to Secure releases.
Select the Repositories tab.
Select the repository name you want to review.
On the Releases tab, review the following fields:
Field
Description
How this helps you
Release name
The name of the release created in GitHub.
Identify and track a specific version of your software.
Release status
Indicates whether the release is active, archived, or otherwise inactive.
Focus on releases that are currently in use or supported.
Tag
The Git tag associated with the release.
Correlate the release to a specific code snapshot.
Vulnerabilities
The number of vulnerabilities identified for this release.
Quickly compare risk across releases and prioritize review.
Source branch
The Git branch from which the release was created.
Trace vulnerabilities back to the originating code branch.
SBOM status
Indicates whether an SBOM (Software Bill of Materials) has been generated and analyzed for the release.
Confirm dependency visibility and supply chain coverage.
Released date
The date the release was published.
Understand the age of the release and assess exposure over time.
Author
The user who created the release.
Identify the point of contact for release inquiries.
On the On-demand scans tab, review the following fields:
Field
Description
How this helps you
On-demand scan
The on-demand security scan configured in the GitHub Actions workflow to run scans based on your schedule or conditions.
Identify and track a specific on-demand security scan.
Vulnerabilities
The number of vulnerabilities identified by the on-demand scan.
Identify risks detected by the on-demand scan and prioritize them for review.
Source branch
The Git branch on which the on-demand scan was run.
Trace vulnerabilities back to the originating code branch.
Monitoring status
Indicates whether the on-demand scan monitored all release artifacts.
Ensure that all release artifacts are scanned on demand to identify and prioritize new vulnerabilities.
Scan date
The date on which the on-demand scan was run.
Understand the age of the scan.
Source
Indicates the VCS system on which the on-demand scan runs.
Understand where the on-demand scan data comes from.
Owner
The person who has triggered the on-demand scan in GitHub.
Identify the point of contact for on-demand scan inquiries.
On the General information tab, review the following fields:
Field
Description
How this helps you
Repository name
The name of the repository connected to Software Trust Manager.
Quickly identify which codebase you are reviewing.
Status
Indicates whether the repository is connected, disconnected, deleted, or access has been revoked.
Confirm that STM can still scan the repository and alert you to connection issues that may need attention.
Monitoring
Shows whether the repository is actively scanned every 24 hours or is inactive.
Ensure critical repositories are being monitored regularly for new vulnerabilities.
Created on
The date the repository was added to Software Trust Manager.
Understand how long the repository has been under monitoring.
Description
A short description of the repository provided by the source system.
Context about the purpose of the repository.
Source
Indicates the system the repository is integrated from.
Understand where the repository data is coming from and which access permissions apply.