Customizable Security Policies

Your organization's Security Policy starts from one of three presets: Essential, Balanced, or Comprehensive. Balanced is the default. Each preset sets an action (Block, Warn, Monitor, or Ignore) for every alert type, and a custom setting on any alert type overrides the preset.

This page covers the Security Policy page in the Socket dashboard. If your organization has migrated to Policies, see Baseline Presets instead.

Choose a preset

Pick the preset that matches how your team reviews dependencies:

• If you want malware and vulnerability coverage like a traditional software composition analysis (SCA) tool, choose Essential. It blocks known malware and warns on critical CVEs.
• If you also want developers warned about supply chain risks such as typosquats, protestware, and git or URL dependencies, choose Balanced. It blocks only known malware. Most teams start here.
• If your team vets new dependencies before adding them, choose Comprehensive. It also blocks critical CVEs, AI-detected potential malware, and git, GitHub, and HTTP dependencies.

Alert actions by preset

The following table lists the action each preset sets for each alert type. Alert types that aren't in the table are set to Ignore in all three presets, so you must enable them yourself.

What each action does

Each action controls where an alert appears and whether it stops a change:

Developers see Block and Warn alerts as GitHub pull request comments and CLI warnings. A Block alert also fails the Socket check on the pull request and makes the CLI exit with an error.

Change the preset or an alert's action

Change your organization's preset or the action for a single alert type on the Security Policy page:

1. In the Socket dashboard, go to Settings → Security Policy.
2. Select Essential, Balanced, or Comprehensive. Alert types set to Inherit switch to the new preset's action.
3. To change one alert type, set its action to Block, Warn, Monitor, or Ignore. This custom setting stays in place when you switch presets. To follow the preset again, set the action back to Inherit.
4. To discard every custom setting, select Remove Custom Settings. Every alert type returns to the preset's action.
5. Check the alert list on the Security Policy page. Each alert type shows the action you chose.

Related topics

• Security Policy (Default Enabled Alerts)
• Baseline Presets
• Migrating to Policies