## Summary
- Adds a nightly GitHub Actions workflow that checks for open security
advisories in triage/draft state
- Sends email alerts via Mailgun when open advisories are found
- Includes the supporting Node.js script at
`scripts/github-security-advisory-alert.mjs`

## Test plan
- [ ] Verify the workflow YAML is valid by triggering a manual
`workflow_dispatch` run
- [ ] Confirm required secrets/vars (`KEPPO_GITHUB_APP_ID`,
`KEPPO_GITHUB_APP_PRIVATE_KEY`, `MAILGUN_API_KEY`, `MAILGUN_DOMAIN`,
`MAILGUN_FROM_EMAIL`, `SECURITY_ADVISORY_ALERT_EMAILS`) are configured
in the `ai-bots` environment

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/3087"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>