A temporary private fork is a private copy of your repository, created from a draft security advisory, where you can fix a vulnerability before publishing. Its limits are real: integrations and CI cannot access it, pull requests merge together rather than one by one, and branch protection rules are not enforced on the target branch.
What it is
GitHub describes it as a private copy made from a draft repository security advisory, for fixing a flaw privately. It applies to repository-level advisories, not to global advisories in the GitHub Advisory Database. Admins on the advisory can add collaborators and merge changes. Collaborators can access the fork, and anyone with write permission on the advisory can commit and open pull requests.
The limits, in a table
| Limit | What it means for you |
|---|---|
| Integrations, including CI, cannot access the fork | Status checks do not run on its pull requests |
| You cannot merge individual pull requests | All open pull requests merge together through the advisory |
| Every open pull request must be mergeable | Resolve conflicts before you merge |
| Branch protection is not enforced on the target branch | Your usual review gates will not stop a merge |
| Only one pull request can target the main branch | A second one blocks the merge |
What to do about no CI
This is the one that surprises people. Because checks do not run, test the fix some other way before the merge:
- Pull the change to a private local clone and run the full test suite there.
- Build the release artifacts locally to check packaging.
- Have a second maintainer review by hand, since automated gates are off.
- Run your linters and security checks manually.
What to do about no branch protection
If your team relies on required reviews, apply that discipline yourself. Agree that nobody merges without a named second reviewer, and write the reviewer's name in the advisory discussion.
Process outline
- Create the draft advisory.
- Start the temporary private fork from the advisory.
- Commit the fix and open the pull request, ready or draft.
- Test outside the fork, as above.
- Merge from the advisory once everything is mergeable.
- Publish the advisory and release the patched version.
Check our publish checklist for the release side, and enable private vulnerability reporting if intake is not set up.
Quick check
Do status checks run in the temporary private fork?
No. GitHub states that integrations, including CI, cannot access it, so checks do not run on its pull requests.
Can I merge one pull request at a time?
No. All open pull requests are merged together through the advisory.
Safeguard's policies and gates can enforce checks on your normal pull requests, and a free scan covers your dependencies before you ship the fix.
Sources
Last reviewed: 19 October 2026.
