Private vulnerability reporting hits general availability on GitHub

GitHub has announced that private vulnerability reporting is now generally available on public repositories. The feature provides a private collaboration channel that allows security researchers and maintainers to disclose and fix vulnerabilities without exposing the issue before a patch is ready.

The public beta was announced at GitHub Universe 2022. Since that launch, maintainers for more than 30,000 organizations have enabled the feature on more than 180,000 repositories, with over 1,000 submissions from researchers.

Early adopters report that the feature improves the disclosure process. JSON5 maintainer Jordan Tucker described the difficulty of accepting a vulnerability report outside of email or public discussion. After an unresponsive submission to another vendor, Tucker enabled private vulnerability reporting on his repository and asked the reporter to submit through GitHub. The fix that followed was credited against CVE-2022-46175 and triggered more than 11 million alerts—work that Tucker emphasizes was only possible through the structured channel.

Private vulnerability reporting makes it so much easier for the open source community to report and fix vulnerabilities, and I would encourage every maintainer to enable it on their public repositories.
- Jordan Tucker, maintainer of JSON5

Security researchers have also found value beyond direct reporting. Marco Squarcina, a postdoctoral researcher at TU Wien's Research Unit Security and Privacy, used the feature to report a cookie security bypass. Because he could submit reports through GitHub’s private channel across multiple projects, Squarcina found it more practical than coordinating via email threads. He is credited on the GitHub Security Advisory GHSA-px8h-6qxv-m22q, which also resulted in CVE-2023-23934.

New features and automation with GA

Several improvements arrived with the general availability release, based on community feedback:

  • Organization-wide enablement. During beta, private vulnerability reporting could only be turned on for individual repositories. Maintainers can now enable the feature for all repositories in an organization.

Now you can enable private vulnerability reporting for all repositories

  • Flexible credit options. Maintainers can select how to credit individuals for vulnerability discovery and remediation contributions.

Maintainers can choose from multiple credit types, including Reporter, Remediation developer, and Sponsor.

Private vulnerability reporting, along with GitHub's broader security tooling such as Dependabot, code scanning, and secret scanning, remains free for public repositories.