Privately reporting a security vulnerability

Some public repositories configure security advisories so that anyone can report security vulnerabilities directly and privately to the maintainers.

Who can use this feature?

Anyone can privately report a security vulnerability to repository maintainers.

Owners and administrators of public repositories can enable private vulnerability reporting on their repositories. See Configuring private vulnerability reporting for a repository.

Note

  • If you have admin or security permissions for a public repository, you don’t need to submit a vulnerability report. Instead, create a draft security advisory directly. See Creating a repository security advisory.
  • Private vulnerability reporting is separate from a repository’s SECURITY.md file. You can only report vulnerabilities privately for repositories where this feature is enabled. If the repository has a security policy, the policy is displayed above the reporting form so you can review the maintainer's guidance before submitting.

If a public repository has private vulnerability reporting enabled, anyone can submit a private vulnerability report to the repository maintainers.

If the repository doesn't have private vulnerability reporting enabled, you need to initiate the reporting process by following the instructions in the security policy for the repository, or by creating an issue asking the maintainers for a preferred security contact. See Coordinated disclosure of security vulnerabilities.

  1. On GitHub, navigate to the main page of the repository.

  2. Under the repository name, click the Security and quality tab. If you cannot see the " Security and quality" tab, select the dropdown menu, and then click Security and quality.

  3. Click Report a vulnerability to open the advisory form.

  4. If the repository has a security policy, review the policy displayed above the form.

  5. Fill in the vulnerability reporting form.

    Tip

    By default, you must provide a summary, details, proof of concept, and impact statement. Maintainers can customize the form and require other information. Provide enough detail for the maintainers to reproduce and assess the vulnerability.

  6. Optionally, select I used AI assistance to find or write up this report.

  7. At the bottom of the form, click Submit report. GitHub will display a message letting you know that maintainers have been notified and that you have a pending credit for this security advisory.

    Tip

    When the report is submitted, GitHub automatically adds the reporter of the vulnerability as a collaborator and as a credited user on the proposed advisory.

  8. Optionally, click Start a temporary private fork if you want to start to fix the issue. Note that only the repository maintainer can merge changes from that private fork into the parent repository.

    Screenshot of the bottom of a security advisory. A button, labeled "Start a temporary fork" is outlined in dark orange.

The next steps depend on the action taken by the repository maintainer. See Managing privately reported security vulnerabilities.

Rate limits for private vulnerability reports

To protect maintainers from spam and abuse, GitHub limits the number of private vulnerability reports that you can submit:

  • You can submit a maximum of 25 reports per 24-hour period across repositories where you are not a trusted reporter.
  • You can submit a maximum of 5 reports to a single repository per 24-hour period.
  • By default, a repository accepts a maximum of 10 reports per 24-hour period from all reporters combined.

Repository maintainers can set a lower or higher total limit for their repository and exempt trusted reporters. Reports to a repository where you are a trusted reporter are exempt from that repository's limits and do not count toward your global 25-report limit. Reports to other repositories still count toward both the global limit and each repository's limits.

If you reach a rate limit, you will see a message when you try to submit a new report on GitHub. Each 24-hour period starts with the first report that counts toward that limit, and the limit resets in full when the period ends.