Privately reporting a security vulnerability

See More

Some public repositories configure security advisories so that anyone can report security vulnerabilities directly and privately to the maintainers.

Who can use this feature?

Anyone can privately report a security vulnerability to repository maintainers.

Owners and administrators of public repositories can enable private vulnerability reporting on their repositories. See Configuring private vulnerability reporting for a repository.

Note

  • If you have admin or security permissions for a public repository, you don’t need to submit a vulnerability report. Instead, create a draft security advisory directly. See Creating a repository security advisory.
  • Private vulnerability reporting is separate from a repository’s SECURITY.md file. You can only report vulnerabilities privately for repositories where this feature is enabled. If the repository has a security policy, the policy is displayed above the reporting form so you can review the maintainer's guidance before submitting.

If a public repository has private vulnerability reporting enabled, anyone can submit a private vulnerability report to the repository maintainers.

If the repository doesn't have private vulnerability reporting enabled, you need to initiate the reporting process by following the instructions in the security policy for the repository, or by creating an issue asking the maintainers for a preferred security contact. See Coordinated disclosure of security vulnerabilities.

  1. On GitHub, navigate to the main page of the repository.

  2. Under the repository name, click the Security and quality tab. If you cannot see the " Security and quality" tab, select the dropdown menu, and then click Security and quality.

  3. Click Report a vulnerability to open the advisory form.

  4. If the repository has a security policy, review the policy displayed above the form.

  5. Fill in the vulnerability reporting form.

    Tip

    By default, you must provide a summary, details, proof of concept, and impact statement. Maintainers can customize the form and require other information. Provide enough detail for the maintainers to reproduce and assess the vulnerability.

  6. Optionally, select I used AI assistance to find or write up this report.

  7. At the bottom of the form, click Submit report. GitHub will display a message letting you know that maintainers have been notified and that you have a pending credit for this security advisory.

    Tip

    When the report is submitted, GitHub automatically adds the reporter of the vulnerability as a collaborator and as a credited user on the proposed advisory.

  8. Optionally, click Start a temporary private fork if you want to start to fix the issue. Note that only the repository maintainer can merge changes from that private fork into the parent repository.

    Screenshot of the bottom of a security advisory. A button, labeled "Start a temporary fork" is outlined in dark orange.

The next steps depend on the action taken by the repository maintainer. See Managing privately reported security vulnerabilities.