How to enable email alerts notification for the developers for security alerts, i have done the required notification settings as well but still no alerts

[deepak-kyndryl]

Select Topic Area

Question

Body

Hi Team,

I want to enable email alerts notification for all the users who are the member of particular repository and also enabled the required notification settings (including repository watch) so that a user can get all the notification as soon as a security alert is getting generated but instead only a user who created that repo with admin access is able to receive such alerts but not the other user who has write permission on it, all though he gets the email notification whenever it creates any pull request or perform merging? please suggest what could be the reason. Thanks

[Pranieth95]

Possible Reasons:

1. Security Alerts Are Only Sent to Admins by Default - GitHub security alerts (e.g., Dependabot alerts for vulnerable dependencies) are typically sent only to repository owners and admins, not users with just "Write" access. Even if a user has "Write" permissions and has enabled repository watch (All Activity), security alerts may not be included in their notifications. So the Admin needs to explicitly add them to security advisories for the repository.

2. User Needs to Enable Security Notifications in GitHub Settings - Users can go to GitHub → Settings → Notifications and ensure that security updates are enabled for repositories they contribute to.

3. Organization-Level Restrictions (If Applicable) - If this is an organization owned repository, check whether the organization has restricted access to security alerts. Organization admins may have configured security notifications to be sent only to certain roles (e.g., Admins or Security Managers).

4. Dependabot and Security Settings - If Dependabot alerts are enabled, check whether the repository is configured to send alerts only to maintainers or specific team members.

Possible workaround:

If you are the repository admin, you can try the following:

1. Go to Repository Settings → Security & analysis.
2. Ensure that Vulnerability alerts and Code scanning alerts are turned ON.
3. If possible, temporarily upgrade the user’s permission to Admin and check if they receive the alerts.
4. Ask the user to check their GitHub notification settings (Settings → Notifications) and enable security alerts.