This repo is the canonical template in ~/notes/security_tooling.md: copy SECURITY.md, .github/dependabot.yml, and .github/workflows/codeql.yml, adapt three fields, done. That covers three of the standard's layers. It does not cover the other five, because they are not files.
Private vulnerability reporting, Dependabot alerts, automated security fixes, secret scanning, and push protection are repo settings, so nothing about copying a template carries them to a new repo. The evidence that this is a real hole rather than a theoretical one is that PVR was off on this repo until 2026-08-07, alongside every other public repo in both orgs — the template itself did not meet the standard it defines, and nobody noticed, because the part it was failing is the part you cannot see in a git diff.
Two things would close it. The scaffolding instructions in the standard need the toggle commands sitting immediately next to the file-copy step rather than in a separate gotchas section further down, so applying the template means running both halves. And the standard's framing needs to change from "copy three files and adapt" to something that names all eight layers up front, because the current wording reads like the file copy is the treatment.
Worth stating in the note as well: on a public repo the toggles are the more valuable half. CodeQL is skipped for most of the fleet on attack-surface grounds, and SECURITY.md is a policy document — the toggles are what actually watch the dependency tree and block a credential from being pushed.
Related: anderix/notes#1, which covers the stale roster in the same file.
This repo is the canonical template in
~/notes/security_tooling.md: copySECURITY.md,.github/dependabot.yml, and.github/workflows/codeql.yml, adapt three fields, done. That covers three of the standard's layers. It does not cover the other five, because they are not files.Private vulnerability reporting, Dependabot alerts, automated security fixes, secret scanning, and push protection are repo settings, so nothing about copying a template carries them to a new repo. The evidence that this is a real hole rather than a theoretical one is that PVR was off on this repo until 2026-08-07, alongside every other public repo in both orgs — the template itself did not meet the standard it defines, and nobody noticed, because the part it was failing is the part you cannot see in a
git diff.Two things would close it. The scaffolding instructions in the standard need the toggle commands sitting immediately next to the file-copy step rather than in a separate gotchas section further down, so applying the template means running both halves. And the standard's framing needs to change from "copy three files and adapt" to something that names all eight layers up front, because the current wording reads like the file copy is the treatment.
Worth stating in the note as well: on a public repo the toggles are the more valuable half. CodeQL is skipped for most of the fleet on attack-surface grounds, and SECURITY.md is a policy document — the toggles are what actually watch the dependency tree and block a credential from being pushed.
Related: anderix/notes#1, which covers the stale roster in the same file.