I cannot seem to detemine whether a repository truly has no security velnerabilities or whether security alerts are disabled for the reposistory as both seem to return empty vulnerabilityAlerts.

Is there a way I can determine the difference between having no vulnerabilityAlerts vs having security alerts disabled?

query:

{
  repository(name: "example-repo", owner: "example-owner") {
    vulnerabilityAlerts(first: 10) {
      nodes {
        id
      }
    }
  }
}

response:

{
  "data": {
    "repository": {
      "vulnerabilityAlerts": {
        "nodes": []
      }
    }
  }
}