GitHub opens its Advisory Database to outside researchers
GitHub has opened its Advisory Database to community contributions, publishing the full contents of the database in a new public repository. The move is intended to let security researchers, academics and enthusiasts add context and intelligence to vulnerability advisories that GitHub's in-house curation team alone might miss.
The database already backs the security audit experience for npm and NuGet, as well as Dependabot alerts and security updates. By exposing it to outside input, GitHub hopes the data will feed additional security experiences across the industry. The data itself has been licensed under Creative Commons since the database was created, so it remains freely available for any consumer.
How community contributions work
Contributors start from any advisory in the GitHub Advisory Database and use the “suggest improvements for this vulnerability” workflow to submit changes. The submission form accepts suggestions on packages, affected versions, impacted ecosystems, and other advisory details.
The workflow walks the contributor through opening a pull request that describes the proposed changes. Once the PR is open, security researchers from the GitHub Security Lab, plus the maintainer of the project that filed the CVE (if known), review the request. Merged contributions earn public credit on the contributor's GitHub profile.
OSV format for interoperability
Advisories in the public GitHub Advisory Database repository use the Open Source Vulnerabilities (OSV) format. Oliver Chang, software engineer on Google's Open Source Security Team, framed the choice as a matter of scalability: vulnerability management for open source depends on advisories that are broadly accessible and easy for anyone to contribute to, and OSV provides that capability.
Background on GitHub's supply chain tooling
The Advisory Database is the foundation of GitHub's supply chain security features. Maintainers of open source repositories can also use GitHub's built-in security advisories feature to report vulnerabilities affecting their own projects. Further details are available in GitHub's documentation on managing vulnerable dependencies and editing security advisories in the database, and the full Advisory Database can be browsed at github.com/advisories.
