What is GitHub's private vulnerability reporting feature?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Private vulnerability reporting is GitHub's built-in responsible disclosure channel. Researchers can report a security flaw directly to the maintainers through GitHub itself — no hunting for an email address, no public issue exposure. Maintainers handle it privately and publish an advisory when it's fixed.
Full explanation below image
Full Explanation
GitHub's private vulnerability reporting feature (also called coordinated vulnerability disclosure) allows security researchers to report security vulnerabilities directly to repository maintainers through a private, encrypted channel on GitHub. The workflow: (1) Researcher uses the 'Report a vulnerability' button on the repository's Security tab. (2) The report is created as a private security advisory, visible only to repository maintainers and the reporter. (3) Maintainers can collaborate with the reporter to understand and fix the vulnerability. (4) Once fixed, maintainers publish the advisory publicly with credit to the reporter. This eliminates the need for out-of-band email communication and keeps vulnerability details private until patched. Repository maintainers must enable this feature in security settings.