New practice vertical: security-response discipline — how fast and how consistently a team triages what its security tooling surfaces. Signals: Dependabot alerts (time-to-patch, dismissal hygiene), secret-scanning alerts (leaked-credential response time, revocation follow-through), code-scanning alerts (static-analysis triage discipline).
The GitHub Apps are already provisioned (2026-09-01, both environments): permissions vulnerability_alerts: read, secret_scanning_alerts: read, security_events: read and events dependabot_alert, secret_scanning_alert, code_scanning_alert — shipping this requires no permission increase and no org re-approval round. Event timestamps (not poll snapshots) are what make response-latency practices measurable.
Scope sketch: ingest the three alert event families + backfill via REST; practice-detection contracts for response-time/dismissal practices; privacy note — alert contents are sensitive; store the minimum (identifiers, states, timestamps), never secret values or vulnerability details beyond severity/state. Sibling of #1403 (CI signals); same ingestion architecture.
Done when the three alert families flow into practice detection with a response-latency practice shipping on at least one of them, and the data-minimization posture is documented in the record of processing.
New practice vertical: security-response discipline — how fast and how consistently a team triages what its security tooling surfaces. Signals: Dependabot alerts (time-to-patch, dismissal hygiene), secret-scanning alerts (leaked-credential response time, revocation follow-through), code-scanning alerts (static-analysis triage discipline).
The GitHub Apps are already provisioned (2026-09-01, both environments): permissions
vulnerability_alerts: read,secret_scanning_alerts: read,security_events: readand eventsdependabot_alert,secret_scanning_alert,code_scanning_alert— shipping this requires no permission increase and no org re-approval round. Event timestamps (not poll snapshots) are what make response-latency practices measurable.Scope sketch: ingest the three alert event families + backfill via REST; practice-detection contracts for response-time/dismissal practices; privacy note — alert contents are sensitive; store the minimum (identifiers, states, timestamps), never secret values or vulnerability details beyond severity/state. Sibling of #1403 (CI signals); same ingestion architecture.
Done when the three alert families flow into practice detection with a response-latency practice shipping on at least one of them, and the data-minimization posture is documented in the record of processing.