A #githubfail for @wezm—if you've turned off PRs for a repo, when you get a dependabot notification it just 404s, since it can't open a PR. There's a perfectly good security tab it could link to.