# Using agents as scaffolding for recurring security-vulnerability tasks

DevFeed: [Using agents as scaffolding for recurring security-vulnerability tasks](<https://devfeed.tech/articles/agents-as-scaffolding-for-recurring-tasks-35682.md>)

Original publisher: [Read original article](<https://lethain.com/agents-as-scaffolding/>)

Published: 2026-04-12T17:00:00Z

Content type: opinion

Language: en

Sources: [Will Larson - Irrational Exuberance](<https://devfeed.tech/sources/will-larson-irrational-exuberance.md>)

Topics: [Agent Framework](<https://devfeed.tech/topics/agent-framework.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Dependabot](<https://devfeed.tech/topics/dependabot.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [Slack](<https://devfeed.tech/topics/slack.md>)

Tags: [agent-framework](<https://devfeed.tech/tags/agent-framework.md>), [agents](<https://devfeed.tech/tags/agents.md>), [dependabot](<https://devfeed.tech/tags/dependabot.md>), [github](<https://devfeed.tech/tags/github.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [slack](<https://devfeed.tech/tags/slack.md>)

## AI overview

The article examines using agents to reduce human involvement in recurring software-company processes. It describes an internal workflow that receives GitHub Dependabot webhooks, filters vulnerability alerts, identifies issue owners through GitHub MCP, and sends alerts to Slack, while noting that the agent could not reliably limit notifications to critical-severity alerts.

## Source excerpt

One of my gifts/curses is an endless fixation with how processes can be optimized. For a brief moment early in my career, that was focused on improving how humans collaborate, but that quickly switched to figuring out how we can minimize human involvement, and eliminate human-to-human handoffs as much as possible. Lately, every time I perform a recurring task-or see someone else perform one-I think about how we might eliminate the human's involvement entirely by introducing agents. This both has worked well, but also worked poorly, and I wanted to highlight the pattern I've found useful. For a concrete example, a problem that all software companies have is patching security vulnerabilities. We have that problem too, and I check our security dashboards periodically to ensure nothing has gone awry. Sometimes when I check that dashboard, I'll notice a finding that's precariously close to our resolution SLAs, and either fix it myself or track down the appropriate team to fix it. However, this feels like a process that shouldn't require me checking on it. Five to six months ago, I added Github Dependabot webhooks as an input into our internal agent framework. Then I set up an agent to handle those webhooks, including filtering incoming messages down to the highest priority issues. About a month ago, when I upgraded from GPT 4.1 to GPT 5.4 with high reasoning, I noticed that it got quite good at using the Github MCP to determine the appropriate owners for a given issue, using the same variety of techniques that a human would use: looking at Codeowners files where available, looking at recent commits on the repository, and so on. The alerts and owners were already getting piped into a Slack channel. So, this worked! However, it didn't actually work that well, because despite repeated iteration on the prompt, including numerous CRITICAL: you must... statements, it simply could not reliably restrict itself to critical severity alerts. It would also include some high severity