If GitHub’s private vulnerability report form is unavailable or unsuitable, publish a clear SECURITY.md with a monitored private contact. Depending on your team and infrastructure, that contact could be a security email, a genuinely confidential issue tracker, or an external coordinated-disclosure platform. Keep intake private, coordinate triage and fixes with the reporter, then publish an advisory and tell users what to do. No single channel fits every project.
What should I do if a repository doesn’t have private vulnerability reporting enabled?
Check the repository’s SECURITY.md or security policy for the project’s preferred contact and instructions. GitHub’s private vulnerability reporting is an opt-in feature for public repositories: an owner or administrator must enable it. A security policy and the private report form are separate mechanisms; a policy may be visible even when the form is not. GitHub’s coordinated disclosure guidance advises reporters to follow the policy when available.
If there is no policy or private contact, ask publicly how to reach the security team, but do not include vulnerability details, proof of concept, or affected systems in the public post. GitHub notes that a public request is immediately visible. Wait for a private route before sending sensitive information. GitHub’s guidance covers this fallback.
How do I report a security vulnerability to an open-source project?
- Find the project’s policy. Look for
SECURITY.md, a security page, or instructions in the repository. If GitHub offers a private reporting form, use it when the project indicates that is the right route. - Use only a channel the project identifies as private. A regular issue, discussion, or email list may be public or broadly accessible. Do not assume a tracker is confidential based on its appearance.
- Send a focused report. Include affected versions or commits, the security impact, reproducible steps or a proof of concept, and a way for maintainers to contact you. Avoid sending unrelated personal or sensitive data.
- Coordinate with maintainers. Allow time for triage, a fix and validation, and an agreed disclosure plan. Do not publish technical details while the project is still handling the vulnerability privately.
GitHub’s coordinated vulnerability disclosure guidance recommends checking the repository policy first and keeping vulnerability details out of a public request for contact.
Recommended Free Tools
#1 Best Overall
What should a security policy tell vulnerability reporters?
A useful policy makes the route easy to find and sets expectations before anyone sends sensitive details. It should explain which versions are supported, where to submit a private report, what information helps with triage, who can access reports, how the project will communicate, and how it expects to announce fixes. Google’s open-source vulnerability guide provides practical guidance for coordinated disclosure.
- Contact: Give a monitored address or secure intake route, ideally under project control. Identify the team or maintainers who can access it.
- Report contents: Ask for affected versions or commits, impact, reproduction steps or proof of concept, and a reply address.
- Handling: Explain how reports are triaged and coordinated, including whether downstream maintainers may need to be contacted.
- Disclosure: Describe how the project plans to coordinate a fix and notify users. State the project’s own timing expectations rather than implying another organization’s deadline applies.
Keep the instructions current. A private address that nobody monitors, or a tracker whose permissions have changed, can leave a reporter without a safe route.
Can maintainers use a private issue tracker or security email instead?
Yes, if the channel is genuinely private, monitored, and appropriate for the project’s access and coordination needs. A simple policy plus a maintained security email can be enough for a small project. A tracker or external platform may add structure, but also requires setup, staffing, and clear terms. Compare the options on confidentiality, discoverability, response capacity, coordination support, integration with releases and packages, and any cost or eligibility requirements.
| Route | Where it fits | What to verify |
|---|---|---|
| Security email or another private contact | Small teams that can monitor and handle reports directly. | Who can access it, whether it is monitored, and how maintainers will coordinate fixes and replies. |
| Confidential issue tracker | Projects whose hosting platform supports restricted security reports and whose maintainers can configure them correctly. | Visibility permissions, notifications, integrations, and who can see existing and future reports. Do not treat an ordinary issue as private. |
| External coordinated-disclosure platform | Projects needing structured intake or help coordinating reports. | Platform terms, access controls, staffing needs, eligibility, and any commercial implications. A bug bounty adds reward-program scope and triage obligations; it is not required to have a disclosure policy. |
| Program-specific channel | Reports within the scope of an existing security program. | Whether the project qualifies and whether the program actually covers this kind of report. |
GitLab documents confidential issue handling and a vulnerability disclosure template, illustrating a tracker-based approach. Maintainers should verify their own instance’s permissions and integrations before sending sensitive information. HackerOne and Bugcrowd document coordinated-disclosure workflows. Google’s OSS-Fuzz has private handling for accepted projects, but its channel concerns bugs found through that program; it is not a general inbox for arbitrary reports.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What happens after a private report arrives?
Receiving a report is only the first part of the process. GitHub describes a typical advisory lifecycle as a private report, maintainer investigation and fix validation, followed by publication and notification to project users or package consumers. Its repository security advisories support private discussion and remediation for public repositories on GitHub.com; this workflow is not a universal service for projects hosted elsewhere. GitHub’s advisory documentation explains the feature.
- Acknowledge and triage: Confirm receipt, assess impact and affected versions, and limit report access to people who need to investigate.
- Coordinate: Keep the reporter informed and involve downstream maintainers where needed to prepare a coordinated fix.
- Fix and validate: Develop a mitigation or patch and check that it addresses the issue before announcing it.
- Disclose and guide users: Publish an advisory when appropriate, identify affected and fixed versions, and give users a clear update or mitigation action.
How long should coordinated disclosure take?
There is no universal deadline established by the cited program policies. Google Security Research describes a 90-day disclosure deadline, with public details released after 90 days or sooner if the vendor releases a fix. Google Security Research’s policy says, “We believe that vulnerability disclosure is a two-way street.”
OSS-Fuzz says it opens reported issues to the public 90 days after notifying project authors, or when a fix is released if that happens sooner. Its guidelines also describe a 14-day grace period when a patch is scheduled. These are Google program policies, not a deadline that automatically applies to unrelated open-source projects. OSS-Fuzz’s disclosure guidelines explain its process. A project should communicate its own expectations and coordinate timing with the reporter and affected downstream users.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is OSV a private reporting alternative?
No. OSV is relevant to publishing and distributing vulnerability information, not confidential intake. It includes a vulnerability schema, reference infrastructure that aggregates and indexes advisory data, and OSV-Scanner tooling. Projects can publish records in the OSV format for consumers to use after or alongside disclosure, but its documentation does not describe it as a private report channel. See the OSV schema documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
