GitHub introduces structured private vulnerability reporting with a mandatory proof of concept
GitHub now offers structured private vulnerability reporting. The default form requires four fields, including a reproducible proof of concept. According to GitHub, the change is meant to make it easier to assess low-quality reports, including those generated using AI.
GitHub has introduced structured forms for private vulnerability reporting. The default form requires a summary, details, a reproducible proof of concept of at least 150 characters, and an impact description. According to GitHub, the previous single text field made it easy to submit low-quality reports or reports generated using AI, and made them harder to assess. The answers are combined into a security advisory description, which maintainers can further review and edit.
Maintainers can define a custom form using the .github/VULNERABILITY_REPORT.yml file in the repository's default branch. The form can also be set for all of an organization's or account's own repositories via the organization's or account's .github repository. Fields support the min_length parameter for the minimum length of a response; if the form is invalid, the default variant is used.
The feature is available for public repositories with private vulnerability reporting enabled, on the GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud plans. A custom form must also apply to reports submitted via the REST API. However, the default form is not enforced via the REST API, so existing integrations can continue to work.
Why it matters
Security researchers get clear requirements for report content, particularly regarding reproducing the issue and describing the impact. Repository maintainers can set the minimum scope of information needed to assess a vulnerability. For companies with automated submission, it matters that the custom form also affects the REST API, whereas the default form does not restrict existing integrations.
Two audiences, two different impacts
What this means
For individuals
When reporting a vulnerability via GitHub's default form, it is necessary to prepare a reproducible proof of concept of at least 150 characters and separately describe the impact.
For a business
A company can unify the documentation needed for assessing vulnerabilities across its own repositories. Introducing a custom form also changes the requirements for reports submitted by company integrations via the REST API.
Risks and complianceCheck the original
Event sources
only one source so far · 1 publisher, 0 independent. We count feeds from the same owner only once.