Dependabot Alerts are generated automatically when a new vulnerable dependency is found.

• A. On every commit
• B. Automatically when a new vulnerable dependency is found
• C. On a weekly schedule
• D. When you run a scan

Answer: (B)

Dependabot Alerts are generated automatically as soon as GitHub detects a known vulnerability in one of your dependencies. The service continuously monitors your dependency graph against the security advisory database, so you’re notified without needing a commit, a scheduled run, or a manual scan. This immediate, event-driven approach helps you act quickly to update or patch vulnerable components. The other options don’t fit because alerts aren’t tied to every commit, they aren’t created on a fixed weekly schedule, and they don’t require you to run a scan to appear.