Post

A GitHub Actions job that only reads Dependabot alerts should not get unrelated token access. Use vulnerability-alerts read at job level. Once you specify permissions, omitted ones become none. https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax#permissions