Post #1579425

@phildini You probably also want to enable secret scanning on the org level if possible, and Zizmor if you use GHA. Unfortunately, I haven't found a good guide to all of the useful things though, and of course any set of recommendations will always have people who disagree. (i.e. I wouldn't put as much emphasis on SBOM as OpenSSF does, etc.)