GitHub Launches Private Vulnerability Reporting for Public Repositories

guest · Nov 12, 2022

By Dennis Fisher @DennisF - November 10, 2022

Vulnerability reporting has always been a complex issue, and it hasn’t gotten much simpler in recent years, especially when it comes to disclosing issues to the maintainers of open source projects. GitHub is hoping to help address this problem with a new feature that allows researchers to report bugs privately and directly to project maintainers.
Click to expand...

The new feature enables the maintainer of a repository on GitHub to turn on the functionality in the security settings, and once it’s enabled, researchers will see a new button that they can use to deliver vulnerability reports privately to the maintainer. GitHub announced the new feature on Wednesday and it is available now for maintainers to try out.

“Private vulnerability reporting is a collaborative solution for security researchers and open source maintainers to report and fix vulnerabilities in open source repositories. It provides a convenient, standardized, and secret way to report, assess, and address vulnerabilities,” GitHub CEO Thomas Dohmke said in a post.
“Private vulnerability reporting makes it easy for community members to privately submit a report within GitHub to public repository owners, who can then take appropriate action within their GitHub workflow.”
Click to expand...

With the new private reporting feature, when a researcher reports a vulnerability, the maintainer of the repository can decide whether to accept it, reject it, or ask some questions of the reporter.
Click to expand...

Configuring private vulnerability reporting for a repository

Owners and administrators of public repositories can allow security researchers to report vulnerabilities securely in the repository by enabling private vulnerability reporting.
Who can use this feature
Anyone with admin permissions to a public repository can enable and disable private vulnerability reporting for the repository.

Note: The private reporting of vulnerabilities is currently in beta and subject to change.
Click to expand...

Log in or Sign up

GitHub Launches Private Vulnerability Reporting for Public Repositories

guest Guest

Log in or Sign up

GitHub Launches Private Vulnerability Reporting for Public Repositories

guest Guest

Useful Searches