Publishing a GitHub security advisory: a pre-publish checklist

Before you publish a repository security advisory, release the patch, add the fixed version, check affected ranges, settle credits and confirm your CVE request. Publishing makes the advisory public and starts GitHub's review, which can take up to 72 hours to reach the Advisory Database and Dependabot alerts.

How the workflow runs

GitHub describes three stages. You draft a private advisory to assess impact, collaborate on the fix in a temporary private fork, and publish once a patch is released. Everything before publication is private, including a CVE request.

The checklist

Fix and release

• The patch is merged and a release containing it exists. Publishing before users can upgrade leaves them informed but stuck.
• You add a fix version to the advisory. GitHub warns that without one, users receive alerts with no safe version to upgrade to. If the fix is not ready, say so in the advisory and update it later, or describe mitigation steps if no fix is planned.

Accuracy

• Affected products list the right ecosystem and package name.
• Affected versions and patched versions are correct, including older release lines you also fixed. Wrong ranges cause both missed alerts and false ones.
• Severity is set, or calculated with CVSS, and the CWE fits the weakness.
• The description states the impact in plain language and links to the fix.

People

• Credits are right. Each credited person can accept or decline, and accepted credits become public on publication.
• The reporter has seen the text and agreed on timing, if you promised coordination.

CVE

• You either entered an existing ID or requested one. GitHub says it usually reviews requests within 72 hours, and cannot assign one if another CNA covers your project. See request a CVE through GitHub.

What publishing does

GitHub says publication makes the advisory data public along with accepted credits. Collaborators can still see the conversation history. The advisory URL stays the same. GitHub reviews published advisories, adds them to the GitHub Advisory Database and may send Dependabot alerts, which can take up to 72 hours. It also publishes CVE details to the MITRE database when it assigned the ID.

After publication

• Announce in your release notes and, if you have one, a mailing list or discussion thread.
• Watch for reports that your fix is incomplete.
• Update the advisory if ranges or details change.

If you want to understand how consumers read your advisory, see how to read a GitHub security advisory.

Quick check

Sources

• GitHub: about repository security advisories
• GitHub: creating a repository security advisory

Last reviewed: 19 October 2026.