Question

A maintainer of a widely-used open source repository in your enterprise organization discovers a serious remote-code-execution vulnerability in the current release. They want to develop and test a fix privately with two external contributors before publicly disclosing anything, then release the patch and publish a CVE simultaneously. Which GitHub feature should they use to accomplish this coordinated disclosure workflow?

Accepted Answer

Create a repository security advisory, which provides a temporary private fork where the maintainer can collaborate with invited contributors and request a CVE identifier before publishing

Answer

Enable Dependabot security updates so GitHub automatically opens a pull request with the fix that stays private until merged

Answer

Create a private branch protected by a ruleset that blocks all pushes except from the invited collaborators until the advisory date

Answer

Turn on secret scanning with push protection so the vulnerability details cannot be accidentally exposed before disclosure