> GitHub tells me about them automatically idk GitHub tells you about published CVEs which represent a small fraction of actual patched security vulnerabilitie

> GitHub tells me about them automatically idk GitHub tells you about published CVEs which represent a small fraction of actual patched security vulnerabilities in the wild, which typically never get a CVE.