GitHub is now also a CVE CNA and can issue its own CVE numbers for bugs disclosed in projects hosted on ... But the Dependency Graph and the Security Alerts feature won't work for all PHP projects.