Security Policy (Default Enabled Alerts)

Your organization's Security Policy sets an action (Block, Warn, Monitor, or Ignore) for each alert type. Balanced is the default preset: it blocks known malware, warns on critical vulnerabilities and supply chain risks, and monitors lower-severity issues. To compare Balanced with the Essential and Comprehensive presets, see Customizable Security Policies.

If your organization has migrated to Policies, see Baseline Presets instead.

Alerts enabled by default

The following table lists the alert types the Balanced preset enables and the action it sets for each one. Every other alert type is set to Ignore.

What each action does

Each action controls where an alert appears and whether it stops a change:

Developers see Block and Warn alerts as GitHub pull request comments and CLI warnings. A Block alert also fails the Socket check on the pull request and makes the CLI exit with an error.

Customize the policy

Override the default actions on the Security Policy page in the Socket dashboard (Settings → Security Policy). Each alert type can use the preset's action (Inherit) or a custom action of its own, and a custom action stays in effect until you change it or select Remove Custom Settings. For the steps, see Change the preset or an alert's action.

For per-repository settings, use the socket.yml file.

Related topics

• Customizable Security Policies
• socket.yml
• Baseline Presets
• Migrating to Policies