Post

Matteo Collina
@nodeland.dev

Big shoutout to @GitHub this week. In two days, they shipped a stack of security advisory updates that maintainers have been asking for for a long time. 🛡️

Matteo Collina
@nodeland.dev

1. Structured forms for private vulnerability reports. No more single free-text box. Now reporters fill in a summary, details, PoC (min 150 chars), and impact. You can even customize the form via .github/VULNERABILITY_REPORT.yml and require a CWE. Reporters can also disclose whether they used AI. 🎯

0 reposts2 likes

Matteo Collina
@nodeland.dev

2. Rate limits for private vulnerability reports. Bulk and automated reports were burying the real ones. Now there's a daily per-user cap, you can set a custom repo limit, and add trusted reporters to an allow list. Legit researchers get through, spam doesn't. github.blog/changelog/20...

Matteo Collina
@nodeland.dev

3. Confidential comments on repository security advisories. Post comments visible only to maintainers. No more moving your abuse/investigation notes to Slack when a reporter can see everything. Clearly marked, permission-aware, and audit-logged. github.blog/changelog/20...

Matteo Collina
@nodeland.dev

4. Repository security advisory comments API (public preview). Until now, the triage discussion lived only in the web UI. Now you can list, get, add, and edit comments via the REST API, and get comment counts in responses. I can now fully automate this via my custom Pi configuration.

github.blogRepository security advisory comments API in public preview - GitHub ChangelogYou can now read, add, and edit comments on repository security advisories using the REST API, including advisories created from private vulnerability reports. Until now, the discussion on an…