GitHub Sets a Retention Policy for Closed Dependabot Alerts
Closed security alerts will move to archival storage after two years, with the change taking effect September 25, 2026.
GitHub announced on June 30, 2026 that it is introducing a data retention policy for closed Dependabot security alerts on github.com and GitHub Enterprise Cloud. The policy does not touch open alerts, which stay fully accessible in the UI and API regardless of how old they are.
Closed alerts are a different story. Under the new policy, a closed alert remains fully accessible for two years after it was closed. Once an alert has been closed for two years or more, it moves into archival storage: it disappears from the normal UI and API views, but administrators, security managers, and organization owners can still retrieve it as a CSV export from the security alerts page at the repository, organization, or enterprise level.
GitHub says archived alerts are preserved "at full fidelity for the life of your account," and that for GitHub Enterprise Cloud customers with data residency requirements, archived alerts stay in the same region as the rest of that account's data. Alerts are only deleted outright if the underlying repository, organization, account, or enterprise agreement itself is terminated.
The policy takes effect September 25, 2026, giving teams roughly three months from the announcement to audit any internal tooling, dashboards, or compliance reports that query closed Dependabot alerts directly, since those queries may need to account for the archival step. GitHub also noted it will give 60 days' notice before extending a similar retention policy to other alert types.
This is a data-lifecycle change rather than a security feature by itself, but it matters for any team using Dependabot alert history as part of an audit trail or compliance record. A dashboard or export job that assumes every closed alert is always one API call away will need to account for the archival step once alerts start aging past the two-year mark.