Question

You maintain a popular open-source library on GitHub. A security researcher privately reports a remote code execution vulnerability affecting your project. As the maintainer, you want to develop and test a fix collaboratively with a few trusted contributors before any details become public, then publish coordinated disclosure with a proper identifier. Which GitHub Security Advisory workflow best supports this goal?

Accepted Answer

Create a draft repository security advisory, use its temporary private fork to collaborate on the fix with selected collaborators, request a CVE identifier through GitHub, and publish the advisory when the patch is released.

Answer

Open a public issue describing the vulnerability so contributors can immediately begin working on a fix in the open, then file for a CVE after merging.

Answer

Push the fix directly to the default branch in a private commit and let Dependabot automatically generate and publish the advisory to the GitHub Advisory Database.

Answer

Create a custom secret scanning pattern to detect the vulnerable code path, then rely on push protection to block downstream consumers from using the affected version.