GitHub announced that private vulnerability reporting is now available to everyone and can be enabled across all repositories owned by an organization.
See also: Twitter: Parts of source code leaked on GitHub
Once enabled, security researchers can use a dedicated communication channel to disclose private security issues to the maintainers of an open source project, without accidentally leaking details of the vulnerability.
GitHub's Eric Tooley and Kate Catlin said this is a private collaboration channel that helps researchers and maintainers report and fix vulnerabilities in public repositories.
During the GitHub Universe 2022, it was announced that more than 30,000 organizations have enabled private vulnerability reporting on more than 180,000 repositories. In addition, more than 1,000 submissions have been received from security researchers regarding this.
During the software's beta testing phase , only maintainers and repository owners on individual repositories could enable private vulnerability reporting . As of this week, the direct vulnerability reporting channel has been enabled for all repositories within an organization.
GitHub has created a new security advisory API that supports integration and automation. This API allows you to send private reports to third-party vulnerability management systems, as well as submit the same report to multiple repositories that share a flaw .
See also: GitHub: Copilot has arrived with GPT-4 built-in!
You can configure it so that private bug reporting is automatically enabled for all new public repositories. The feature can be enabled in the “ Security and Code Analysis ” section by clicking the “ Enable All ” button next to the “ Private Vulnerability Reporting ” option .
Owners and administrators of public repositories should change their private vulnerability reporting so that they receive bug reports on their same resolution platform, discuss all the details with researchers, and securely collaborate with them to create a patch.
Once enabled, researchers can submit private security reports directly to GitHub. To do this, they need to go to the Security tab under the repository name and click on the “Report Vulnerability” option on the left side of the screen, under “Report” > “Tips”.
You can send private bug reports via the GitHub REST API using the parameters described on the documentation page.
Last month, GitHub announced that its service is now available for all public repositories.
See also: GitHub's Secret Scanning Alerts: Available for free in public repositories
Developers from all over the world use GitHub to share code, collaborate with team members, and create amazing projects. With millions of users, GitHub has quickly become an indispensable tool for any programming project. Whether you're a new or experienced developer, understanding the ins and outs of GitHub can give you a competitive advantage.
