Automatically assign vulnerabilities

Use this article when new vulnerabilities should automatically route to a default owner for each repository.

How auto assignment works

• A repository can have a default assignee.

• New vulnerabilities in that repository inherit the default assignee.

• You can still reassign or unassign any vulnerability after it is created.

• Clearing the default assignee stops automatic routing for future vulnerabilities in that repository.

Where to configure it

• Open the repository settings for the repository you want to route.

• Set Default Assignee.

• Review newly created vulnerabilities to confirm they receive the expected owner.

Important behavior

• Auto assignment applies only to newly created vulnerabilities.

• Existing vulnerabilities are not retroactively assigned when the default assignee changes.

• Manual reassignment still works for individual vulnerabilities.

Canonical docs

For the maintained reference, see Auto assignment, Vulnerability list view, and Vulnerability detail view.

Contact support if

• New vulnerabilities are not assigned to the configured default assignee.

• A vulnerability was assigned to an unexpected owner.

• The repository default assignee cannot be changed or cleared.