What is a GitHub 'repository security advisory' and what does it publish?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A repository security advisory is how maintainers officially disclose a vulnerability in their code. They draft it privately, coordinate with the reporter and GitHub to get a CVE, then publish the advisory so users know what's affected and how to fix it.
Full explanation below image
Full Explanation
GitHub Repository Security Advisories are a mechanism for project maintainers to document and disclose security vulnerabilities in their code. The lifecycle: (1) Draft phase — maintainers create a private advisory with details: description, affected versions, CVSS score, CWE classification. Can be created from a private vulnerability report. (2) Optional CVE request — maintainers can request a CVE (Common Vulnerabilities and Exposures) identifier directly through GitHub. (3) Publication — when the vulnerability is fixed, maintainers publish the advisory. Published advisories: appear in the GitHub Advisory Database, generate Dependabot alerts in downstream projects using the affected package, and are linked from the repository's Security tab. This process enables responsible disclosure with coordinated timing between fix availability and public disclosure.