D'oh.

One was noting the missing LICENSE, another was noting the missing SECURITY.md, and the other one was a policy bot nagging the repo owner to follow a process to exclude the code from the "Microsoft Internal Github" "to protect Microsoft's property"