Doesn't github do that with the dependabot alerts, for free? On each push and via email. Why would you pick this one when you get that without even turning it on
There are 2 problems with dependabot,
1: it requires you to have a code on github orherwise you can't receive alerts
2: they send months old alerts, even if you go to check security advisory of github, you'll notice the date of those issues will be very old.
Further, vulert is also 100% free for open source software.
I don't know if this is true, I saw a couple of Neo4j vulnerabilities show up as soon as the next day once it was disclosed.