Secret Sauce

Try it now:

1. In a repository, open the Security and quality tab, then pick Vulnerabilities under Dependabot in the Findings sidebar.
2. Keep the default Most important sort, which weighs signals such as CVSS score and dependency scope, or type scope:development in the search bar to see which alerts only touch development dependencies.
3. Open an alert and use the Assignees menu to give it an owner, which can be a person, a team or an AI agent.

Try it now:

1. In a terminal, run code --list-extensions --show-versions to see every extension VS Code has installed and which version you’re on.
2. To update by hand instead, run the Disable Auto Update for Extensions command (or change the extensions.autoUpdate setting), and run Enable Auto Update for Extensions to switch it back on.
3. To go back to a release you trust, right-click the extension in the Extensions view, choose Install Another Version and pick one from the list.

Try it now:

1. On GitHub, open your repository’s Settings, then click Actions and General in the left sidebar.
2. Under “Actions permissions”, choose “Allow OWNER, and select non-OWNER, actions and reusable workflows”, then list the outside actions your workflows still need.
3. To lock every action to one exact version, also tick “Require actions to be pinned to a full-length commit SHA”, then click Save. An organization or enterprise policy can override these settings.

Try it now:

1. On GitHub, open your repository’s Settings, then Advanced Security in the “Security and quality” section of the sidebar.
2. Next to Dependabot alerts, click Enable. For every repo you own at once, use Enable all in your account’s security settings and tick “Enable by default for new repositories.”
3. From then on, Dependabot raises an alert when it finds a vulnerable dependency, and people with write, maintain or admin access to the repo get notified.

Try it now:

1. Open your agent settings (Cline, Copilot, Claude Code, Cursor — wherever you live).
2. Explicitly pick the model you want this week so a quiet release cannot swap the chef under you.
3. Recheck cost dashboards after any "default model" note in release notes — surprises usually show up on the bill first.