Introducing Pull Request Stories to Help Security Teams Track Supply Chain Risks

Socket’s GitHub app scans every pull request and reports on problematic dependencies, with alerts flowing into the dashboard to give security teams full visibility into their supply chain.

As teams grow and the number of scans increases, it becomes harder to track which ones introduced risks and how those risks were resolved. To make this easier, we’re introducing Pull Request Stories, a new dashboard feature that summarizes every scanned PR and highlights its security impact at a glance.

Pull Request Story Table#

In the dashboard, under the Scans page, you’ll now find a dedicated Pull Requests tab.

This tab shows a list of all recently scanned pull requests, along with a summary of the alerts flagged on each.

Instead of simply repeating GitHub’s pull request information, this page reinterprets each PR in terms of supply chain and security impact. In other words, it tells a “story” of what’s really happening with dependencies.

For instance, Socket creates a title for each PR that re-describes it in terms of what dependencies are changing. You can still hover to see the developer’s original title, but the Socket-generated title helps security teams understand the supply chain implications at a glance.

We also provide a before-and-after comparison of each PR, which we call the peak state and the final state. These allow you to see the “worst potential impact” and “real outcome” to your security posture, for each PR. If developers bypass alerts before merging, these cases are surfaced with a “suppressed” badge. Since our bot always comments with recommendations, developers often fix issues in follow-up commits. This means there may be several scans per PR.

• Peak state: shows the scan where a pull request triggered the most severe alerts, the maximum potential risk that could have been introduced (or might still be if unmerged).
• Final state: shows the last scan once the PR is merged, capturing the alerts that were actually accepted into the main branch.

For a quick overview of recent pull requests, you can quickly narrow the view with filters, selecting a date range or specific story types to focus on the PRs most relevant to your team.

Pull Request Page#

While it is possible to open the actual pull request in the version control system for more details, we also provide a pull request details page in our dashboard. This can be accessed by clicking any of the rows in the pull request story table.

The PR detail page gives an overview of the risks introduced (or about to be introduced) into the repository. We display a small table of the direct dependencies changed and a table of the respective alerts detected. This information mirrors one-to-one the details that our GitHub app posted in the pull request itself.

We built this feature in close collaboration with our customers, gathering feedback throughout design and rollout. With Pull Request Stories, security teams now have clear visibility into how each PR impacts their supply chain, from potential risks to actual outcomes. We’ll keep building on this foundation with richer insights and workflow improvements, and we welcome your feedback on what would make it most valuable for your team.