How the routine works
Two templates share the responsibility. The weekly security audit reads the repository and its security signals every Monday morning, prioritizes newly introduced or materially changed risks over known background noise, and writes a brief with severity, evidence, and a recommended owner for each finding. The dependency vulnerability triage runs separately, checks whether each open advisory is actually reachable in your code, and proposes an upgrade order with the smallest safe bumps.
Both run read-only. If you later want findings turned into tracking issues, you enable that specific tool on the connection and approve it for automatic execution — until then, every run ends in a report.
What a run reports
A typical brief opens with anything new since last week, then works down: a route added without the auth middleware the sibling routes use, a dependency advisory that is exploitable only if you call the affected function (you do not — filed as noise, with the reason), a secret that moved from config to code in a recent commit. Each item links the evidence so review starts from the diff, not from trust.
Setting it up
Connect GitHub, choose the template, point it at your repository, and run it once manually. Read the trace, tighten the instructions if the first brief covers the wrong things, then turn on the schedule. The security category page has both templates and the access each needs.