github-security-report 0.4.1__tar.gz → 0.6.0__tar.gz

{github_security_report-0.4.1 → github_security_report-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github-security-report
-Version: 0.4.1
+Version: 0.6.0
 Summary: Security and quality reporting across GitHub organisations
 Project-URL: Homepage, https://github.com/lfreleng-actions/github-security-report-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github-security-report-action
@@ -29,15 +29,15 @@ Requires-Dist: jinja2==3.1.6
 Requires-Dist: jsonschema==4.26.0
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: rich==15.0.0
-Requires-Dist: typer==0.26.7
+Requires-Dist: typer==0.26.8
 Provides-Extra: dev
 Requires-Dist: mypy==2.1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio==1.4.0; extra == 'dev'
 Requires-Dist: pytest-cov==7.1.0; extra == 'dev'
 Requires-Dist: pytest==9.1.1; extra == 'dev'
 Requires-Dist: respx==0.23.1; extra == 'dev'
-Requires-Dist: ruff==0.15.19; extra == 'dev'
-Requires-Dist: syrupy==5.3.3; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'
+Requires-Dist: syrupy==5.3.4; extra == 'dev'
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == 'dev'
 Requires-Dist: types-pyyaml==6.0.12.20250915; extra == 'dev'
 Description-Content-Type: text/markdown
@@ -87,7 +87,7 @@ back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
 [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
 API research it is built on.
 
-Two further sections report **configuration posture** and **freshness** as plain
+Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
 
 - **Dependabot** — three tables: repositories with vulnerability **alerts not
@@ -101,6 +101,12 @@ tables (org mode):
   release or tag is older than `release_max_age_days` (default 60; `0` flags
   every eligible repository), so a repository released or tagged within that
   window counts as recently maintained and drops out of the table.
+- **Private Vulnerability Reporting** — repositories where GitHub's private
+  vulnerability reporting feature is **not enabled**, so security researchers
+  cannot privately disclose vulnerabilities. Probed per repository (GitHub
+  exposes no org-wide or GraphQL equivalent) and, like every other category,
+  always collected; hide it with the `private_vulnerability_reporting` render
+  toggle.
 
 ## Operating modes
 
@@ -176,7 +182,7 @@ organisations. Grant these scopes:
 
 > For organisations that enforce SSO, the PAT must be **SSO-authorised** for
 > each target organisation, or the org-level endpoints return `403` (reported as
-> unknown). Store the token as a secret (e.g. `SECURITY_REPORT_PAT`) and
+> unknown). Store the token as a secret (e.g. `LFRELENG_ACTIONS_REPORT_PAT`) and
 > reference it by env-var name via `token_env`; never embed it in the config.
 
 ## Usage
@@ -190,7 +196,9 @@ organisations. Grant these scopes:
   with:
     scope: "org"
     config: "${{ secrets.GSR_CONFIG || vars.GSR_CONFIG }}"
-    token: "${{ secrets.SECURITY_REPORT_PAT }}"
+    token: "${{ secrets.LFRELENG_ACTIONS_REPORT_PAT }}"
+    # Must match the per-org "token_env" in your config (below).
+    token_env: "LFRELENG_ACTIONS_REPORT_PAT"
     output_dir: "site"
     pages_url: "https://lfreleng-actions.github.io/github-security-report-action/"
 ```
@@ -235,7 +243,7 @@ environment-variable name, never embedded.
   "organizations": [
     {
       "name": "lfreleng-actions",
-      "token_env": "GITHUB_TOKEN",
+      "token_env": "LFRELENG_ACTIONS_REPORT_PAT",
       "exclude": ["actions-template"],
       "releases_exclude": ["internal-only-repo"]
     }
@@ -305,7 +313,8 @@ out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
 `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
-`mutable_releases`. Like the other `report` settings, `categories` can be set
+`mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
+settings, `categories` can be set
 globally and overridden per organisation (overrides merge key-by-key, so
 flipping one output leaves the rest untouched). The machine-readable
 `report.json` artifact always contains the complete dataset, regardless of these
@@ -326,8 +335,11 @@ The severity-ranked signals (CodeQL, Scorecard, Zizmor, Dependabot alerts) use a
 repository is flagged as an offender only when it carries a finding **at or
 above** the cutoff; findings below it fold into the clean count. Severities run
 (lowest to highest) `informational`, `low`, `medium`, `high`, `critical` —
-`informational` being the new sub-low rung that SARIF `note`/`none` findings
-(the bulk of a tool like Zizmor) normalise to.
+`informational` being the sub-low rung for SARIF `none` findings and
+unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
+(zizmor emits its Low findings at `note`, and the organisation scan pipeline's
+`--min-severity low` floor keeps informational findings out of the uploaded
+SARIF), matching the ruleset-enforced PR gate that blocks on note-and-above.
 
 The global default cutoff is `medium`, so `low` and `informational` findings
 pass. Zizmor defaults to `low` (only `informational` passes). Override the
@@ -365,7 +377,7 @@ $XDG_CONFIG_HOME/github-security-report/config.json
 An explicit `--config`, `--config-data`, or `--org` always takes precedence, and
 the action itself never reads this path (it is supplied configuration directly).
 Secrets stay out of the file: reference the token by environment-variable name
-via `token_env` (e.g. `SECURITY_REPORT_PAT`, exported in your shell or sourced
+via `token_env` (e.g. `LFRELENG_ACTIONS_REPORT_PAT`, exported in your shell or sourced
 from a secrets file) — the channel ID is the only Slack value the file holds,
 and the Slack **bot token** is consumed by the workflow, not the CLI.
 
@@ -380,7 +392,7 @@ and the Slack **bot token** is consumed by the workflow, not the CLI.
 | `org` | No | — | Single organisation (shorthand for org mode) |
 | `repo` | No | detected | `owner/name` for repo mode |
 | `token` | No | `${{ github.token }}` | PAT (org mode) or `GITHUB_TOKEN` (repo mode) |
-| `token_env` | No | `GITHUB_TOKEN` | Env var name the tool reads the token from |
+| `token_env` | No | `GITHUB_TOKEN` | Env var name the token is exported under. In org mode it **must match** the per-org `token_env` in your config (e.g. `LFRELENG_ACTIONS_REPORT_PAT`), otherwise the tool looks up an unset variable and reports no token. |
 | `output_dir` | No | — | Directory for Pages output (org mode) |
 | `pages_url` | No | — | Published Pages URL (used in the Slack link) |
 | `slack_channel` | No | — | Slack channel ID; overrides the config `slack.channel` (e.g. the `SLACK_CHANNEL_ID` variable) |
@@ -417,8 +429,57 @@ uvx github-security-report report
 uvx github-security-report report --org lfreleng-actions
 ```
 
+## Remediation
+
+The `remediate` subcommand is the in-tool counterpart to the report: it runs the
+same collection, then switches on each selected security feature wherever a
+repository has it **confirmed off**. Only the offenders the report already
+surfaces are acted on — repositories whose state could not be read are counted
+as *unknown* and are never written to, so remediation never blind-writes.
+
+It is **dry run by default** (these are privileged writes); pass `--apply` to
+make changes. A single **write-capable** org-admin token (from `--token-env`,
+default `GITHUB_TOKEN`) drives both the read and the writes across every
+configured organisation, so it bypasses the per-org read-only `token_env` in the
+config.
+
+```bash
+# An org-admin token is required: a classic PAT with the `repo` scope
+# (administers repository security settings) plus `read:org` to enumerate repos.
+source ~/.secrets.github.classic.god   # exports $GITHUB_TOKEN
+
+# Dry run (default): preview every change, touch nothing.
+uvx github-security-report remediate --org lfreleng-actions
+
+# Apply: enable every remediable feature that is off, across all configured orgs.
+uvx github-security-report remediate \
+  --config ~/.config/github-security-report/config.json --apply
+
+# Limit to specific categories (repeatable).
+uvx github-security-report remediate --org lfreleng-actions \
+  --category codeql --category private_vulnerability_reporting --apply
+```
+
+The remediable categories are the simple on/off features with a documented
+enablement endpoint:
+
+| `--category` | Enables |
+|---|---|
+| `codeql` | CodeQL default setup (provisioned asynchronously) |
+| `secret_scanning` | Secret scanning |
+| `dependabot_alerts_enabled` | Dependabot vulnerability alerts |
+| `dependabot_updates_enabled` | Dependabot security updates (plus alerts) |
+| `private_vulnerability_reporting` | Private vulnerability reporting |
+
+Qualitative findings (Scorecard, zizmor, open Dependabot alerts, cooldown,
+release freshness/mutability) are reported but not auto-remediated. Remediation
+is organisation-scoped (`--scope org`, the default and only supported scope).
+
 ## Bulk Remediation Scripts
 
+The standalone scripts below predate the `remediate` subcommand and remain for
+ad-hoc, single-feature runs. For most workflows, prefer `remediate` above.
+
 The report ends with **nag lists** — repositories where a supported feature is
 switched off. Where GitHub exposes the relevant toggle through its REST API,
 the [`scripts/`](scripts/) directory ships standalone helpers that clear a whole
@@ -440,7 +501,8 @@ the current state of each repository, enables the feature where it is off, and
 verifies the result.
 
 ```bash
-# An org-admin token is required (classic PAT with repo admin / admin:org).
+# An org-admin token is required: a classic PAT with the `repo` scope
+# (administers repository security settings) plus `read:org` to enumerate repos.
 source ~/.secrets.github.classic.god   # exports $GITHUB_TOKEN
 
 # Dry run (default): preview every change, touch nothing.

{github_security_report-0.4.1 → github_security_report-0.6.0}/README.md

@@ -43,7 +43,7 @@ back to code-scanning findings. See [`docs/BRIEF.md`](docs/BRIEF.md) and
 [`docs/phase0-findings.md`](docs/phase0-findings.md) for the full design and the
 API research it is built on.
 
-Two further sections report **configuration posture** and **freshness** as plain
+Further sections report **configuration posture** and **freshness** as plain
 tables (org mode):
 
 - **Dependabot** — three tables: repositories with vulnerability **alerts not
@@ -57,6 +57,12 @@ tables (org mode):
   release or tag is older than `release_max_age_days` (default 60; `0` flags
   every eligible repository), so a repository released or tagged within that
   window counts as recently maintained and drops out of the table.
+- **Private Vulnerability Reporting** — repositories where GitHub's private
+  vulnerability reporting feature is **not enabled**, so security researchers
+  cannot privately disclose vulnerabilities. Probed per repository (GitHub
+  exposes no org-wide or GraphQL equivalent) and, like every other category,
+  always collected; hide it with the `private_vulnerability_reporting` render
+  toggle.
 
 ## Operating modes
 
@@ -132,7 +138,7 @@ organisations. Grant these scopes:
 
 > For organisations that enforce SSO, the PAT must be **SSO-authorised** for
 > each target organisation, or the org-level endpoints return `403` (reported as
-> unknown). Store the token as a secret (e.g. `SECURITY_REPORT_PAT`) and
+> unknown). Store the token as a secret (e.g. `LFRELENG_ACTIONS_REPORT_PAT`) and
 > reference it by env-var name via `token_env`; never embed it in the config.
 
 ## Usage
@@ -146,7 +152,9 @@ organisations. Grant these scopes:
   with:
     scope: "org"
     config: "${{ secrets.GSR_CONFIG || vars.GSR_CONFIG }}"
-    token: "${{ secrets.SECURITY_REPORT_PAT }}"
+    token: "${{ secrets.LFRELENG_ACTIONS_REPORT_PAT }}"
+    # Must match the per-org "token_env" in your config (below).
+    token_env: "LFRELENG_ACTIONS_REPORT_PAT"
     output_dir: "site"
     pages_url: "https://lfreleng-actions.github.io/github-security-report-action/"
 ```
@@ -191,7 +199,7 @@ environment-variable name, never embedded.
   "organizations": [
     {
       "name": "lfreleng-actions",
-      "token_env": "GITHUB_TOKEN",
+      "token_env": "LFRELENG_ACTIONS_REPORT_PAT",
       "exclude": ["actions-template"],
       "releases_exclude": ["internal-only-repo"]
     }
@@ -261,7 +269,8 @@ out of the terminal and Slack while still publishing it to the Markdown and HTML
 Pages output. The valid category keys are: `codeql`, `scorecard`, `zizmor`,
 `dependabot_alerts`, `secret_scanning`, `dependabot_alerts_enabled`,
 `dependabot_updates_enabled`, `dependabot_cooldown`, `releases`,
-`mutable_releases`. Like the other `report` settings, `categories` can be set
+`mutable_releases`, `private_vulnerability_reporting`. Like the other `report`
+settings, `categories` can be set
 globally and overridden per organisation (overrides merge key-by-key, so
 flipping one output leaves the rest untouched). The machine-readable
 `report.json` artifact always contains the complete dataset, regardless of these
@@ -282,8 +291,11 @@ The severity-ranked signals (CodeQL, Scorecard, Zizmor, Dependabot alerts) use a
 repository is flagged as an offender only when it carries a finding **at or
 above** the cutoff; findings below it fold into the clean count. Severities run
 (lowest to highest) `informational`, `low`, `medium`, `high`, `critical` —
-`informational` being the new sub-low rung that SARIF `note`/`none` findings
-(the bulk of a tool like Zizmor) normalise to.
+`informational` being the sub-low rung for SARIF `none` findings and
+unclassifiable alerts. Zizmor's SARIF `note` findings normalise to `low`
+(zizmor emits its Low findings at `note`, and the organisation scan pipeline's
+`--min-severity low` floor keeps informational findings out of the uploaded
+SARIF), matching the ruleset-enforced PR gate that blocks on note-and-above.
 
 The global default cutoff is `medium`, so `low` and `informational` findings
 pass. Zizmor defaults to `low` (only `informational` passes). Override the
@@ -321,7 +333,7 @@ $XDG_CONFIG_HOME/github-security-report/config.json
 An explicit `--config`, `--config-data`, or `--org` always takes precedence, and
 the action itself never reads this path (it is supplied configuration directly).
 Secrets stay out of the file: reference the token by environment-variable name
-via `token_env` (e.g. `SECURITY_REPORT_PAT`, exported in your shell or sourced
+via `token_env` (e.g. `LFRELENG_ACTIONS_REPORT_PAT`, exported in your shell or sourced
 from a secrets file) — the channel ID is the only Slack value the file holds,
 and the Slack **bot token** is consumed by the workflow, not the CLI.
 
@@ -336,7 +348,7 @@ and the Slack **bot token** is consumed by the workflow, not the CLI.
 | `org` | No | — | Single organisation (shorthand for org mode) |
 | `repo` | No | detected | `owner/name` for repo mode |
 | `token` | No | `${{ github.token }}` | PAT (org mode) or `GITHUB_TOKEN` (repo mode) |
-| `token_env` | No | `GITHUB_TOKEN` | Env var name the tool reads the token from |
+| `token_env` | No | `GITHUB_TOKEN` | Env var name the token is exported under. In org mode it **must match** the per-org `token_env` in your config (e.g. `LFRELENG_ACTIONS_REPORT_PAT`), otherwise the tool looks up an unset variable and reports no token. |
 | `output_dir` | No | — | Directory for Pages output (org mode) |
 | `pages_url` | No | — | Published Pages URL (used in the Slack link) |
 | `slack_channel` | No | — | Slack channel ID; overrides the config `slack.channel` (e.g. the `SLACK_CHANNEL_ID` variable) |
@@ -373,8 +385,57 @@ uvx github-security-report report
 uvx github-security-report report --org lfreleng-actions
 ```
 
+## Remediation
+
+The `remediate` subcommand is the in-tool counterpart to the report: it runs the
+same collection, then switches on each selected security feature wherever a
+repository has it **confirmed off**. Only the offenders the report already
+surfaces are acted on — repositories whose state could not be read are counted
+as *unknown* and are never written to, so remediation never blind-writes.
+
+It is **dry run by default** (these are privileged writes); pass `--apply` to
+make changes. A single **write-capable** org-admin token (from `--token-env`,
+default `GITHUB_TOKEN`) drives both the read and the writes across every
+configured organisation, so it bypasses the per-org read-only `token_env` in the
+config.
+
+```bash
+# An org-admin token is required: a classic PAT with the `repo` scope
+# (administers repository security settings) plus `read:org` to enumerate repos.
+source ~/.secrets.github.classic.god   # exports $GITHUB_TOKEN
+
+# Dry run (default): preview every change, touch nothing.
+uvx github-security-report remediate --org lfreleng-actions
+
+# Apply: enable every remediable feature that is off, across all configured orgs.
+uvx github-security-report remediate \
+  --config ~/.config/github-security-report/config.json --apply
+
+# Limit to specific categories (repeatable).
+uvx github-security-report remediate --org lfreleng-actions \
+  --category codeql --category private_vulnerability_reporting --apply
+```
+
+The remediable categories are the simple on/off features with a documented
+enablement endpoint:
+
+| `--category` | Enables |
+|---|---|
+| `codeql` | CodeQL default setup (provisioned asynchronously) |
+| `secret_scanning` | Secret scanning |
+| `dependabot_alerts_enabled` | Dependabot vulnerability alerts |
+| `dependabot_updates_enabled` | Dependabot security updates (plus alerts) |
+| `private_vulnerability_reporting` | Private vulnerability reporting |
+
+Qualitative findings (Scorecard, zizmor, open Dependabot alerts, cooldown,
+release freshness/mutability) are reported but not auto-remediated. Remediation
+is organisation-scoped (`--scope org`, the default and only supported scope).
+
 ## Bulk Remediation Scripts
 
+The standalone scripts below predate the `remediate` subcommand and remain for
+ad-hoc, single-feature runs. For most workflows, prefer `remediate` above.
+
 The report ends with **nag lists** — repositories where a supported feature is
 switched off. Where GitHub exposes the relevant toggle through its REST API,
 the [`scripts/`](scripts/) directory ships standalone helpers that clear a whole
@@ -396,7 +457,8 @@ the current state of each repository, enables the feature where it is off, and
 verifies the result.
 
 ```bash
-# An org-admin token is required (classic PAT with repo admin / admin:org).
+# An org-admin token is required: a classic PAT with the `repo` scope
+# (administers repository security settings) plus `read:org` to enumerate repos.
 source ~/.secrets.github.classic.god   # exports $GITHUB_TOKEN
 
 # Dry run (default): preview every change, touch nothing.

{github_security_report-0.4.1 → github_security_report-0.6.0}/pyproject.toml

@@ -45,7 +45,7 @@ keywords = [
 ]
 dependencies = [
   "httpx[http2]==0.28.1",
-  "typer==0.26.7",
+  "typer==0.26.8",
   "rich==15.0.0",
   "jinja2==3.1.6",
   "jsonschema==4.26.0",
@@ -63,9 +63,9 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.3",
+  "syrupy==5.3.4",
   "mypy==2.1.0",
-  "ruff==0.15.19",
+  "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]
@@ -95,9 +95,9 @@ dev = [
   "pytest-asyncio==1.4.0",
   "pytest-cov==7.1.0",
   "respx==0.23.1",
-  "syrupy==5.3.3",
+  "syrupy==5.3.4",
   "mypy==2.1.0",
-  "ruff==0.15.19",
+  "ruff==0.15.20",
   "types-jsonschema==4.26.0.20260518",
   "types-PyYAML==6.0.12.20250915",
 ]

{github_security_report-0.4.1 → github_security_report-0.6.0}/src/github_security_report/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.4.1'
-__version_tuple__ = version_tuple = (0, 4, 1)
+__version__ = version = '0.6.0'
+__version_tuple__ = version_tuple = (0, 6, 0)
 
 __commit_id__ = commit_id = None

{github_security_report-0.4.1 → github_security_report-0.6.0}/src/github_security_report/categories.py

@@ -38,6 +38,7 @@ class CategoryKey(str, Enum):
     DEPENDABOT_COOLDOWN = "dependabot_cooldown"
     RELEASES = "releases"
     MUTABLE_RELEASES = "mutable_releases"
+    PRIVATE_VULNERABILITY_REPORTING = "private_vulnerability_reporting"
 
 
 @dataclass(frozen=True)
@@ -104,8 +105,9 @@ _CATEGORIES: dict[CategoryKey, CategoryMeta] = {
             "Zizmor static analysis of GitHub Actions workflows, ranked "
             "worst-first by severity."
         ),
-        # Zizmor's advisory "note" findings normalise to informational; only
-        # those pass. A low-or-higher zizmor finding is treated as a failure.
+        # zizmor emits its Low findings at SARIF level "note", which
+        # normalises to LOW (see severity.py), so any zizmor finding fails --
+        # matching the ruleset-enforced PR gate that blocks on note-and-above.
         fail_severity=Severity.LOW,
     ),
     CategoryKey.DEPENDABOT_ALERTS: CategoryMeta(
@@ -210,6 +212,22 @@ _CATEGORIES: dict[CategoryKey, CategoryMeta] = {
             "cannot change after the fact."
         ),
     ),
+    CategoryKey.PRIVATE_VULNERABILITY_REPORTING: CategoryMeta(
+        key=CategoryKey.PRIVATE_VULNERABILITY_REPORTING,
+        title="Private Vulnerability Reporting",
+        pass_label="Enabled",
+        fail_label="Not enabled",
+        url=(
+            "https://docs.github.com/en/code-security/security-advisories/"
+            "working-with-repository-security-advisories/"
+            "configuring-private-vulnerability-reporting-for-a-repository"
+        ),
+        description=(
+            "Repositories with private vulnerability reporting disabled. Enable "
+            "it so security researchers can privately report vulnerabilities "
+            "instead of disclosing them publicly."
+        ),
+    ),
 }
 
 

{github_security_report-0.4.1 → github_security_report-0.6.0}/src/github_security_report/cli.py

@@ -17,7 +17,7 @@ import logging
 import os
 import re
 import sys
-from collections.abc import Callable, Mapping
+from collections.abc import Callable, Mapping, Sequence
 from dataclasses import replace
 from pathlib import Path
 from typing import NoReturn
@@ -26,6 +26,7 @@ import typer
 from rich.console import Console
 
 from github_security_report import __version__, collect, config, gitctx, runner
+from github_security_report import remediate as remediate_mod
 from github_security_report.categories import CategoryKey
 from github_security_report.client import GitHubClient, NetworkError
 from github_security_report.config import Config, OrgConfig, ReportConfig
@@ -48,7 +49,10 @@ def _version_callback(value: bool) -> None:
     if value:
         # Match the dependamerge style: a label emoji plus a Rich-highlighted
         # version number (Rich colourises the numeric version automatically).
-        Console().print(f"🏷️  github-security-report version {__version__}")
+        # A single space follows the emoji: terminals that honour the VS16
+        # emoji-presentation width (e.g. Ghostty) render it two cells wide, so
+        # the extra pad the old double space added now reads as a gap.
+        Console().print(f"🏷️ github-security-report version {__version__}")
         raise typer.Exit()
 
 
@@ -133,6 +137,11 @@ def _org_to_dict(org: OrgReport) -> dict:
         "mutable_releases": (
             _table_to_dict(org.mutable_releases) if org.mutable_releases else None
         ),
+        "private_vulnerability_reporting": (
+            _table_to_dict(org.private_vulnerability_reporting)
+            if org.private_vulnerability_reporting
+            else None
+        ),
     }
 
 
@@ -415,6 +424,43 @@ async def _run_repo(owner: str, repo_name: str, *, token_env: str, console: Cons
     return 0
 
 
+async def _run_remediate(
+    cfg: Config,
+    *,
+    console: Console,
+    token: str,
+    categories: Sequence[CategoryKey],
+    apply: bool,
+) -> int:
+    """Collect each org's posture and enable (or preview enabling) features.
+
+    A single write-capable token drives both the read (collection) and the
+    writes for every configured org, so the per-org read ``token_env`` in the
+    config is intentionally bypassed. Returns 1 when any enable failed, else 0.
+    """
+    now = dt.datetime.now(dt.timezone.utc)
+    failures = 0
+    async with GitHubClient(token) as client:
+        for org_cfg in cfg.organizations:
+            report = await collect.collect_org(
+                client, org_cfg, org_cfg.report, generated_at=now
+            )
+            results = await remediate_mod.remediate_org(
+                client, report, categories=categories, apply=apply
+            )
+            # Honour the org's configured terminal offender limit, the same
+            # cap the report's CLI output uses, so large orgs stay readable.
+            term_render.render_remediation(
+                report.org,
+                results,
+                console,
+                apply=apply,
+                top_n=org_cfg.report.cli_top_n,
+            )
+            failures += sum(result.failures for result in results)
+    return 1 if failures else 0
+
+
 def _repo_outputs(signals: list[RepoSignal], fail_threshold: str) -> dict[str, str]:
     outputs = {s.signal.value + "_open": str(s.counts.total) for s in signals}
     outputs["failed"] = "true" if runner.should_fail(signals, fail_threshold) else "false"
@@ -532,5 +578,75 @@ def report(
     raise typer.Exit(code)
 
 
+@app.command()
+def remediate(
+    config_file: str | None = typer.Option(None, "--config", "-c", help="Path to a JSON config file."),
+    config_data: str | None = typer.Option(None, "--config-data", help="Raw or base64 JSON config (vars/secrets)."),
+    org: str | None = typer.Option(None, "--org", help="Single organisation (shorthand for org mode)."),
+    scope: str = typer.Option("org", "--scope", help="Only 'org' is supported; remediation is organisation-scoped."),
+    category: list[str] | None = typer.Option(None, "--category", help="Remediable category to act on (repeatable; default: all). One of: codeql, secret_scanning, dependabot_alerts_enabled, dependabot_updates_enabled, private_vulnerability_reporting."),
+    token_env: str = typer.Option("GITHUB_TOKEN", "--token-env", help="Env var holding a WRITE-capable org-admin PAT. Used for both reading posture and enabling features across every configured org."),
+    apply: bool = typer.Option(False, "--apply", help="Perform the writes. Without this flag remediate only previews (dry run)."),
+    no_color: bool = typer.Option(False, "--no-color", help="Disable coloured output."),
+) -> None:
+    """Enable security features on repositories that lack them.
+
+    Runs the same collection the report uses, then switches on each selected
+    remediable feature wherever a repository has it confirmed off. Dry run by
+    default: pass --apply to make changes. Requires a write-capable token
+    (org admin), distinct from the read-only reporting PAT.
+    """
+    plain = no_color or bool(os.environ.get("CI")) or not sys.stdout.isatty()
+    console = Console(no_color=plain, highlight=False)
+
+    if scope != "org":
+        console.print("[red]remediate supports only --scope org[/red]")
+        raise typer.Exit(2)
+
+    keys, unknown = remediate_mod.parse_categories(category or [])
+    if unknown:
+        valid = ", ".join(key.value for key in remediate_mod.REMEDIABLE)
+        # markup=False: the user-supplied --category values are printed
+        # literally, so bracketed input cannot be interpreted as Rich markup.
+        console.print(
+            f"Unknown --category: {', '.join(unknown)}. Valid values: {valid}",
+            style="red",
+            markup=False,
+        )
+        raise typer.Exit(2)
+    categories = keys or list(remediate_mod.REMEDIABLE)
+
+    cfg = _load_config(config_file, config_data, org, token_env, console=console)
+    if cfg is None:
+        console.print(
+            "[red]No configuration: provide --config, --config-data or --org.[/red]"
+        )
+        raise typer.Exit(2)
+
+    token = os.environ.get(token_env, "").strip()
+    if not token:
+        # markup=False guards the user-supplied --token-env value.
+        console.print(
+            f"No token in ${token_env} (a write-capable org-admin PAT is required).",
+            style="red",
+            markup=False,
+        )
+        raise typer.Exit(2)
+
+    try:
+        code = asyncio.run(
+            _run_remediate(
+                cfg,
+                console=console,
+                token=token,
+                categories=categories,
+                apply=apply,
+            )
+        )
+    except NetworkError as exc:
+        _abort_network(console, exc)
+    raise typer.Exit(code)
+
+
 if __name__ == "__main__":  # pragma: no cover
     app()