Socket.dev
Purpose
Syncs Socket.dev supply-chain data: organizations, monitored repositories, open-source dependencies, security alerts (CVEs, malware, supply-chain risk, license violations), and available fixes.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
socketdev_token |
Yes | Socket.dev API token |
Setup Steps
- In the Socket.dev dashboard, go to Settings → API Tokens and create a new token. See the Socket.dev API token docs for details.
- Grant the token these read scopes:
repo:list,repo:readalert:list,alert:readdependencies:read
- In SubImage, enter the token in
socketdev_token(or its AWS Secret ARN) and save the module.
The sync discovers every organization visible to the token.