GitHub Private Vulnerability Reporting: Audit and Enable It Org-Wide

GitHub's documentation, read on 18 October 2026, says owners and administrators of public repositories can enable private vulnerability reporting, and that researchers then use a Report a vulnerability button on the repository's Advisories page, or the REST API. For one repository that is four clicks. For an organization with dozens of public repositories, the failure is not the setting but the repositories where nobody turned it on.

What's affected

Organizations with public repositories on GitHub. The setting is per repository. For the organization level, the docs point to a custom security configuration. Three details change how well it works:

• Notifications. Admins and security managers are notified only if they watch the repository for all activity or subscribe to security alerts, and have email notifications on.
• Custom form. A file named VULNERABILITY_REPORT.yml or .yaml in a .github directory replaces the default form. A repository form overrides the owner's .github repository form, and if GitHub cannot parse it, reporters see the default form.
• CWE requirement. Under Submission requirements you can require at least one CWE on new reports. It applies to web and API reports, not to advisories maintainers create.

What to do now

1. Audit. The REST API has a check endpoint, so list every public repo and its state:

ORG=your-org
gh repo list "$ORG" --visibility public --no-archived --limit 1000 \
  --json name --jq '.[].name' | while read -r r; do
  printf '%s ' "$r"
  gh api "repos/$ORG/$r/private-vulnerability-reporting" --jq '.enabled'
done

2. Enable on the gaps. The API uses PUT /repos/{owner}/{repo}/private-vulnerability-reporting and needs admin access to the repository:

gh api -X PUT "repos/$ORG/REPO_NAME/private-vulnerability-reporting"

3. For new repositories, use a custom security configuration so the setting is not a manual step.
4. Add a SECURITY.md that links to the Advisories page and a fallback mailbox.
5. Decide who is notified. Name two people per repo, and have both confirm that a test report reaches their inbox.
6. Re-run the audit each quarter and after creating repositories.

Quick check

Sources

• GitHub Docs: Configuring private vulnerability reporting for a repository
• GitHub Docs: Configuring private vulnerability reporting for an organization
• GitHub REST API: repositories