Where else should we enable this bot?

[StanFromIreland]

It's currently installed on cpython and pythondotorg. I suggest we install it also on:

• python/pymanager (we'll also have to add it to the CVE_ENABLED list)
• python/release-tools
• python/blurb_it
• python/docsbuild-scripts
• python/memory.python.org
• python/codespeed
• python/pythontestdotnet

Being able to handle reports there may be useful in the future. Some repositories already have gotten reports (e.g., memory.python.org). What do people think?

[sethmlarson]

All of these repositories make sense to me, I think the bot should be enabled for all repositories with GHSA under python/. We probably want to enable private vulnerability reporting and create SECURITY.md for more repositories, too.

[StanFromIreland]

@python/organization-owners (sorry for the work, I'd do it myself if I could), please install the psrt-ghsa-bot app for the repositories listed above, and enable private vulnerability reporting (GitHub Security Advisories) for them if they aren't already.

I'll take care of the SECURITY.mds.

[encukou]

Can we do the SECURITY.md PRs first, to notify the people watching the repos and give them a chance to comment?

[StanFromIreland]

In that case can we enable private vulnerability reporting first, then do SECURITY.mds, and finally enable the bot?