Following a beta launch in November 2022, GitHub has now made private vulnerability reporting generally available, providing security researchers with a direct channel to report security defects they identify in public repositories.
To take advantage of the new capability, repository maintainers need to enable it in the ‘Security’ section of their repository’s ‘Settings’.
Once private vulnerability reporting has been enabled, security researchers can send bug reports to the maintainers, who can request for additional information and avoid being contacted publicly.
