These 'security.md' files would work for me just as well to define a security contact, but I've never come across one of these in the wild... so I end up wasting my time hunting down maintainers and their email addresses, when everyone involved would have a much easier time if it were all handled through Github by allowing everyone to create a (draft) 'maintainer advisory'.
And your security team gets an organization wide overview of the security results as well https://docs.gitlab.com/ee/user/application_security/securit...
include: template: SAST.gitlab-ci.yml
Now do the same with Dependency Scanning, Container Scanning, DAST and License Compliance if needed.
Note that Auto-DevOps enables this automatically.
On a general note, I agree with you, Security should be available out of the box for everyone. I created last month this issue for this purpose, feel free to comment or watch it.
Nice. I hope we contributed to it in some way: https://news.ycombinator.com/item?id=13667386
