Enable GitHub private vulnerability reporting in five steps

Owners and administrators of a public GitHub repository can enable private vulnerability reporting in Settings, under Advanced Security. Once on, the Advisories page shows a Report a vulnerability button, so researchers can send findings privately instead of filing a public issue. Set up notifications so the reports reach someone.

Steps

1. Open the repository and go to Settings.
2. Find Advanced Security in the Security and quality section.
3. Under Private vulnerability reporting, click Enable.
4. Confirm that the Advisories page now shows Report a vulnerability.
5. Check who gets notified, covered below.

Organization owners can also enable it more widely through a custom security configuration, according to GitHub's documentation.

Notifications: the step people skip

GitHub notifies administrators and security managers of new private reports only if they watch the repository with All Activity, or with Security alerts under Custom, and have notifications enabled for it. For email, they must also select Email under Subscriptions in their personal notification settings.

A private channel nobody sees is worse than none, because the reporter assumes you are ignoring them. After enabling the feature, ask a teammate to file a test report and confirm the alert arrives.

Customise the report form

You can add a VULNERABILITY_REPORT.yml (or .yaml) file to the repository's .github directory. You can also set a default form in an organization's or account's .github repository, and the repository-level form wins if both exist.

The form uses issue-form YAML syntax. It supports checkboxes, dropdowns, inputs, markdown and textareas, and you can mark fields required and set minimum lengths. If GitHub cannot parse or validate the form, reporters see the default form. Reports sent through the REST API must include the sections your custom form requires.

Useful fields to ask for are affected version, reproduction steps, impact, and whether the reporter plans to publish.

Require a CWE

Under Private vulnerability reporting, click Settings and turn on Require a CWE assignment. It applies to new reports submitted in the web interface or through the API. It does not apply to advisories maintainers create, or to edits of existing reports. Use it if you want reporters to classify the weakness, and skip it if it would put off first time reporters.

What happens next

A report becomes a private conversation. From there you can follow the flow in request a CVE as a maintainer and the publishing checklist in publish a GitHub security advisory.

Pair the setting with a SECURITY.md that tells reporters what to expect: write a SECURITY.md.

Quick check

Sources

• GitHub: configuring private vulnerability reporting

Last reviewed: 19 October 2026.