Question

You administer a public repository for an open-source project on GitHub Enterprise Cloud. External security researchers have been opening public issues to disclose vulnerabilities, exposing flaws before a patch is available. As part of defining a coordinated security response plan, you want researchers to be able to report vulnerabilities confidentially and collaborate with maintainers on a fix without public exposure. Which action best meets this requirement?

Accepted Answer

Enable private vulnerability reporting on the repository so researchers can submit reports through a confidential channel that maintainers manage as draft security advisories

Answer

Enable Dependabot alerts so researchers are automatically notified when they attempt to report a known vulnerability

Answer

Disable public issues entirely and instruct researchers to email the maintainers directly with vulnerability details

Answer

Create a public security advisory template so researchers file structured issues that are hidden from search indexes