They serve different stages of vulnerability handling. Private vulnerability reporting is the way a researcher privately sends a vulnerability report to a repository’s maintainers, when the repository has enabled the feature. A repository security advisory is the maintainer-managed record and workflow for discussing the issue, preparing a fix, and deciding when to disclose it publicly. The terms are connected, but they are not competing features or interchangeable names.
How the two features differ
| Question | Private vulnerability reporting | Repository security advisory |
|---|---|---|
| Main purpose | Privately submit a vulnerability report to maintainers. | Privately manage assessment and remediation, then publish an advisory if appropriate. |
| Who starts it? | Any reporter, if the repository has enabled private reporting. | A maintainer or other user with the required repository role; a private report can also initiate a proposed advisory workflow. |
| What information or work is involved? | The default form asks for a summary, details, proof of concept, and impact statement. Maintainers can customize the form. | The draft can record the vulnerability description, affected products and versions, severity, weaknesses, optional CVE information, and credits. |
| Who can see it? | The report is handled privately while maintainers assess it. | The advisory is private while in draft; its current advisory data becomes public when published. Collaborators can view the conversation history. |
| What happens next? | The reporter and maintainers can collaborate; the reporter may optionally start a temporary private fork. | Maintainers coordinate a fix and choose when to publish. Published data may be reviewed for GitHub’s Advisory Database and may support Dependabot alerts. |
GitHub documents both features for public repositories on GitHub.com. The repository owner or an administrator controls whether private vulnerability reporting is enabled; the repository security advisory workflow requires an appropriate role. These details should not be assumed to apply to every GitHub product, plan, or private repository. See GitHub’s repository security advisories documentation and private reporting guide.
If you are reporting a vulnerability
- Check the repository’s security policy and reporting option. If private vulnerability reporting is available, open the repository’s Report a vulnerability form.
- Make the report actionable. Explain the issue, how to reproduce it, and its impact. Include a proof of concept where appropriate, and provide any additional information requested by the repository’s policy or customized form.
- Submit privately and coordinate with maintainers. GitHub says submission adds the reporter as a collaborator and credited user on the proposed advisory. You may optionally start a temporary private fork to help develop a fix; only a maintainer can merge changes from that fork into the parent repository.
- If private reporting is off, use the repository’s policy. If no policy or security contact is listed, ask publicly for the preferred contact without including vulnerability details in the issue. GitHub’s coordinated disclosure guidance recommends working with maintainers and allowing time for remediation. Do not assume compensation unless the project has a public bounty program.
If you maintain a repository
Enable and configure private intake
For a repository-level setting, GitHub documents the path Settings → Advanced Security → Private vulnerability reporting. Repository owners and administrators can enable the feature. GitHub also documents organization-level configuration. To tailor the questions researchers see, add VULNERABILITY_REPORT.yml or VULNERABILITY_REPORT.yaml under .github; a repository-level form takes precedence over an owner’s default form. See GitHub’s configuration instructions.
Manage the advisory and remediation
A maintainer or user with the required role can create a draft repository security advisory, discuss the impact privately, coordinate a patch, and publish when ready. Record affected package, ecosystem, and version information, severity, and a fix version where possible, so users can identify a safe version to install. GitHub explains the fields and workflow in its guide to creating a repository security advisory.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
Keep CVE assignment and publication distinct
If a CVE identification number is needed, GitHub says an eligible request usually receives review within 72 hours; this is an estimate, not a guaranteed turnaround. Requesting a CVE does not itself make an advisory public. If GitHub assigns one, the CVE details are published after the advisory is publicly released. After publication, GitHub reviews the advisory for its Advisory Database and may use it to issue Dependabot alerts; GitHub says that review and potential alert process can take up to 72 hours. An alert is not guaranteed. See the official advisory guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Publication is a separate decision
A private submission is not a public disclosure. The report and advisory collaboration give maintainers and the reporter a private path to assess the issue and work on remediation. The maintainer decides when to publish the advisory. Once published, its data can help inform the GitHub Advisory Database and potentially Dependabot alerts, but those downstream outcomes are not promises that every advisory will produce an alert.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
