OpenAgentsControl/docs/maintenance/repository-recovery/private-vulnerability-reporting-evidence.md

GitHub Security Settings — Change Evidence

Repository-recovery Task 07 (private vulnerability reporting), plus the Dependency Graph prerequisite discovered during Task 08. Repository: darrenhinde/OpenAgentsControl (public). Date: 2026-07-15.

Each change below was explicitly approved immediately before it was made, and verified by read-back. No other repository setting was modified.

Change 1 — Dependency Graph / Dependabot alerts (Task 08 prerequisite)

Discovered while adding dependency-review.yml: the Dependency Review action fails with "Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled" unless the Dependency Graph is on.

Step	Command	Result
Before	GET /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts	HTTP 404 (disabled)
Enable	PUT /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts	HTTP 204
Read-back	GET /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts	HTTP 204 (enabled)

Verification: the Dependency Review check on PR #336 went from fail (4s, "Dependency graph is not enabled") to pass (9s) after this change.

Change 2 — Private vulnerability reporting (Task 07)

Makes the reporting path documented in SECURITY.md live.

Step	Command	Result
Before	GET /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting	{"enabled": false}
Enable	PUT /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting	HTTP 204
Read-back	GET /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting	{"enabled": true}

Verification: the repository Security tab now offers Report a vulnerability, so the path documented in SECURITY.md resolves.

Settings not changed

Confirmed unchanged before and after (GET /repos/{owner}/{repo} → security_and_analysis):

{
  "dependabot_security_updates": { "status": "disabled" },
  "secret_scanning": { "status": "enabled" },
  "secret_scanning_non_provider_patterns": { "status": "disabled" },
  "secret_scanning_push_protection": { "status": "enabled" },
  "secret_scanning_validity_checks": { "status": "disabled" }
}

Note: dependabot_security_updates (automated fix PRs) remains disabled — it was not in scope for Task 07 and would require its own approval. Dependabot alerts are now on via the Dependency Graph change above; .github/dependabot.yml is scoped to github-actions updates only.

Reversal

Both changes are reversible with the corresponding DELETE calls:

• DELETE /repos/{owner}/{repo}/private-vulnerability-reporting
• DELETE /repos/{owner}/{repo}/vulnerability-alerts