HIGH
Source
Trivy
ID
AVD-GIT-0003

GitHub repository has vulnerability alerts disabled.

GitHub repository should be set to use vulnerability alerts.

You can do this by setting the vulnerability_alerts attribute to ‘true’.

Impact

Known vulnerabilities may not be discovered

Follow the appropriate remediation steps below to resolve the issue.

Enable vulnerability alerts

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
 resource "github_repository" "good_example" {
   name        = "example"
   description = "My awesome codebase"

   vulnerability_alerts = true

   template {
     owner = "github"
     repository = "terraform-module-template"
   }
 }