Question

You are a maintainer of a popular open-source library. A researcher privately reports a deserialization flaw. You create a draft GitHub Security Advisory, collaborate on a fix in a temporary private fork, and prepare to publish. Before publishing, you want Dependabot to alert downstream consumers with an accurate severity and to properly attribute the reporter. Which action ensures both a machine-readable severity for downstream Dependabot alerts and correct researcher attribution when the advisory is published?

Accepted Answer

Assign a CVSS vector/score and affected version ranges in the advisory, and add the researcher to the advisory credits before publishing

Answer

Publish the advisory with only a free-text severity note, then email the reporter a thank-you so their contribution is documented outside GitHub

Answer

Request a CVE identifier first and wait for NVD to assign the CVSS score, since GitHub cannot store severity data on the advisory itself

Answer

Add the reporter as a repository collaborator so they appear in the advisory, and set the severity by choosing a branch protection rule level