Assign owners to remediation work

Use owner mappings

Owner mappings assign alerts to a person, email, team key, repository, or path pattern. This gives engineers a queue that matches responsibility instead of a single security-team inbox.

Combine automatic and manual ownership

Use repository mappings for broad routing and manual assignment for exceptions. If CODEOWNERS import is enabled for your GitHub App installation, imported owners can improve path-level routing.

Review unowned work

Unowned alerts should be reviewed every week. Repeated unowned alerts usually mean repository ownership, package ownership, or CODEOWNERS coverage needs maintenance.