triaging-security-findings

Scanner Landscape

Bitwarden uses Aikido as its unified security platform. Aikido continuously scans connected repositories and surfaces findings across SAST, IaC, SCA (open source), secrets, cloud, container, malware, EOL, and license categories in a single feed.

Findings are queried and triaged via the aikido:issues skill (aikido_issues_list), not through GitHub code-scanning alerts — Aikido triage does not flow through GitHub Advanced Security. See that skill for the full list of scope filters, issue_types, and SLA filters (out_of_sla, sla_due_soon).

If the aikido:issues skill is unavailable (the aikido plugin isn't installed or /aikido:setup hasn't run), stop and tell the user rather than proceeding without this data. This applies to Aikido feed triage only — the Dependabot and secret-scanning paths below are GitHub-native and run without Aikido.

GitHub-Native Alerts (Dependabot, Secret Scanning)

Dependabot and GitHub secret scanning are unaffected by the Aikido transition — they remain GitHub-native and are queried separately from the Aikido feed.

Dependabot Alerts

# List open Dependabot alerts
gh api --method GET -H "X-GitHub-Api-Version: 2026-03-10" /repos/{owner}/{repo}/dependabot/alerts --jq '.[] | {number, state, severity: .security_vulnerability.severity, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem}'