✨feat: Add Private Vulnerability Reporting probe to Security-Policy check

[Ironankit525]

Overview

This PR introduces a new probe that detects whether GitHub's Private Vulnerability Reporting (PVR) feature is enabled on repositories, enhancing the Security-Policy check with visibility into GitHub's native vulnerability reporting mechanism.

Implementation Details

Core Changes

Interface Extension

• Added HasPrivateVulnerabilityReportingEnabled() method to the RepoClient interface

GitHub Client Implementation

• Implemented API integration using the /repos/{owner}/{repo}/private-vulnerability-reporting endpoint
• Requires read-only access to repository metadata

Multi-Platform Support

• Added stub implementations returning ErrUnsupportedFeature for:
  • GitLab
  • Local directory
  • Git
  • Azure DevOps
  • OSS-Fuzz

Probe Implementation

• Created privateVulnerabilityReportingEnabled probe with three outcome states
• Integrated probe into Security-Policy check workflow
• Added comprehensive test coverage

Outcome States

Outcome | Description -- | -- OutcomeTrue | Private Vulnerability Reporting is enabled OutcomeFalse | Private Vulnerability Reporting is available but not enabled OutcomeNotApplicable | Feature not available (non-GitHub repositories)

Change Type

 Feature - New capability for detecting GitHub Private Vulnerability Reporting status

Behavioral Changes

Before

The Security-Policy check evaluated only:

• Presence of security policy files
• Content quality of security documentation

After

The Security-Policy check now additionally evaluates:

• Whether GitHub's Private Vulnerability Reporting feature is enabled
• Provides actionable insights for improving vulnerability disclosure processes

Testing

•  Comprehensive unit tests added
•  Integration tests for GitHub client
•  Edge case handling verified
•  Multi-platform stub implementations tested

Compliance Checklist

•  PR title follows project contribution guidelines
•  Code changes include appropriate tests
•  Documentation updated where applicable

GitHub Issue

None - This is a new feature enhancement

Reviewer Notes

Important Considerations

Scoring Impact

• This probe is informational only
• Does not currently affect Security-Policy scores
• Provides visibility for future policy decisions

Platform Compatibility

• GitHub repositories: Full functionality
• Non-GitHub platforms: Returns OutcomeNotApplicable
• No breaking changes to existing checks

API Requirements

• Uses GitHub's standard REST API
• Requires only read access to public repository metadata
• No authentication changes needed

User Impact

What Users Will See

Users running the Security-Policy check will now receive information about whether their GitHub repository has Private Vulnerability Reporting enabled. This helps teams understand their vulnerability disclosure posture and make informed decisions about security reporting mechanisms.

Example Output

✓ Security policy file exists
✓ Security policy contains contact information
ℹ Private Vulnerability Reporting: Enabled

Release Notes

release

Security-Policy check now detects GitHub Private Vulnerability Reporting status via new privateVulnerabilityReportingEnabled probe

---

Additional Context

Private Vulnerability Reporting is GitHub's built-in feature that allows security researchers to privately report vulnerabilities directly through the GitHub interface. This probe helps maintainers understand whether they're leveraging this native GitHub capability alongside traditional SECURITY.md files.

[github-actions]

This pull request has been marked stale because it has been open for 10 days with no activity