Turn on CodeQL, Dependabot, and Secret Scanning across a handful of repositories and you get exactly what the marketing promised: findings. Lots of them. Each one sitting in its own repository's Security tab, behind its own set of tabs and filters, with no shared notion of who owns this , when is it due , or are we getting better or worse . That's the gap. GitHub is genuinely world-class at the detection half of application security. The operational half - triage, deadlines, ownership,...