# GitHub Security Settings — Change Evidence

_Repository-recovery Task 07 (private vulnerability reporting), plus the
Dependency Graph prerequisite discovered during Task 08._
_Repository: `darrenhinde/OpenAgentsControl` (public). Date: 2026-07-15._

Each change below was explicitly approved immediately before it was made, and
verified by read-back. No other repository setting was modified.

## Change 1 — Dependency Graph / Dependabot alerts (Task 08 prerequisite)

Discovered while adding `dependency-review.yml`: the Dependency Review action
fails with _"Dependency review is not supported on this repository. Please ensure
that Dependency graph is enabled"_ unless the Dependency Graph is on.

| Step | Command | Result |
|------|---------|--------|
| Before | `GET /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts` | `HTTP 404` (disabled) |
| Enable | `PUT /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts` | `HTTP 204` |
| Read-back | `GET /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts` | `HTTP 204` (enabled) |

**Verification:** the `Dependency Review` check on PR #336 went from `fail` (4s,
"Dependency graph is not enabled") to `pass` (9s) after this change.

## Change 2 — Private vulnerability reporting (Task 07)

Makes the reporting path documented in `SECURITY.md` live.

| Step | Command | Result |
|------|---------|--------|
| Before | `GET /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting` | `{"enabled": false}` |
| Enable | `PUT /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting` | `HTTP 204` |
| Read-back | `GET /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting` | `{"enabled": true}` |

**Verification:** the repository Security tab now offers **Report a
vulnerability**, so the path documented in `SECURITY.md` resolves.

## Settings not changed

Confirmed unchanged before and after (`GET /repos/{owner}/{repo}` →
`security_and_analysis`):

```json
{
  "dependabot_security_updates": { "status": "disabled" },
  "secret_scanning": { "status": "enabled" },
  "secret_scanning_non_provider_patterns": { "status": "disabled" },
  "secret_scanning_push_protection": { "status": "enabled" },
  "secret_scanning_validity_checks": { "status": "disabled" }
}
```

Note: `dependabot_security_updates` (automated fix PRs) remains **disabled** —
it was not in scope for Task 07 and would require its own approval. Dependabot
alerts are now on via the Dependency Graph change above; `.github/dependabot.yml`
is scoped to `github-actions` updates only.

## Reversal

Both changes are reversible with the corresponding `DELETE` calls:

- `DELETE /repos/{owner}/{repo}/private-vulnerability-reporting`
- `DELETE /repos/{owner}/{repo}/vulnerability-alerts`