Problem
repo_security_plan reports no SAST, SCA, or secrets scanning configured. While no secrets or injection risks were found in the current source, the org baseline scanners are absent.
Suggested fix
When adding CI (see related issue), include at minimum gitleaks (secrets) and npm audit / osv-scanner (SCA). Optionally add Semgrep or CodeQL for SAST. Keep it to the top recommendation per category to avoid the redundant-scanner overlap the security plan flagged.
Problem
repo_security_planreports no SAST, SCA, or secrets scanning configured. While no secrets or injection risks were found in the current source, the org baseline scanners are absent.Suggested fix
When adding CI (see related issue), include at minimum gitleaks (secrets) and
npm audit/ osv-scanner (SCA). Optionally add Semgrep or CodeQL for SAST. Keep it to the top recommendation per category to avoid the redundant-scanner overlap the security plan flagged.