What shipped? GitHub code scanning now lets you dismiss an alert with a new Mitigated reason.
What changed? Previously, dismissals were effectively "won't fix" or "false positive." Now, when a vulnerability stays in the code but external controls — a web application firewall, network policy, or compensating control — neutralize the risk, you can dismiss it as Mitigated. That keeps the decision inside GitHub, distinct from "won't fix," and gives you a clean trail to align with formal exception and risk-acceptance processes.
Why does a builder care? Security teams that run code scanning at scale were tracking "we know about this but it's behind a WAF" decisions in spreadsheets. This closes that gap: the audit trail lives in the alert itself, and the reason is explicit instead of a stretch-marked "won't fix."