I haven't used the security alerts, but isn't the idea that you open an issue and then track it there using the regular project management tools?
> Snyk(blarghh)
What's wrong with Snyk?
> Snyk(blarghh)
What's wrong with Snyk?
The main issue is that issues are publicly viewable, while security alerts are only available to certain users (e.g. repo admins). Since repo owners of e.g. popular OSS repos might not want public issues around their security vulnerabilities, this isn't something that's been actioned.
Should GitHub offer more granular permissions on issues to resolve this? Probably, but unfortunately that's reaching fairly deep into how GitHub works today.
(Disclosure: former Dependabot PM, no longer at GitHub)