Post

Big shoutout to @GitHub this week. In two days, they shipped a stack of security advisory updates that maintainers have been asking for for a long time. 🛡️

6/10/26, 3:59 pm3 reposts13 likes

Matteo Collina

@nodeland.dev

1. Structured forms for private vulnerability reports. No more single free-text box. Now reporters fill in a summary, details, PoC (min 150 chars), and impact. You can even customize the form via .github/VULNERABILITY_REPORT.yml and require a CWE. Reporters can also disclose whether they used AI. 🎯

Matteo Collina

@nodeland.dev

Announcement: github.blog/changelog/20...

github.blogStructured forms for private vulnerability reports - GitHub ChangelogPrivate vulnerability reports can now use a structured form that asks reporters for the details you need to assess a vulnerability, including a reproducible proof of concept. A single free-text…

Matteo Collina

@nodeland.dev

2. Rate limits for private vulnerability reports. Bulk and automated reports were burying the real ones. Now there's a daily per-user cap, you can set a custom repo limit, and add trusted reporters to an allow list. Legit researchers get through, spam doesn't. github.blog/changelog/20...

Matteo Collina

@nodeland.dev

3. Confidential comments on repository security advisories. Post comments visible only to maintainers. No more moving your abuse/investigation notes to Slack when a reporter can see everything. Clearly marked, permission-aware, and audit-logged. github.blog/changelog/20...