Question

A maintainer of a widely-used open-source library receives a private report that a deserialization flaw allows remote code execution. They want to fix the issue without tipping off attackers before users can patch, and they want a CVE assigned through GitHub. Using the GitHub Security Advisory end-to-end workflow, which sequence of actions correctly achieves coordinated disclosure?

Accepted Answer

Draft a repository security advisory (kept private), collaborate on a fix in a temporary private fork tied to the advisory, request a CVE identifier through the advisory, then publish the advisory and release the patched version.

Answer

Open a public issue describing the vulnerability, push the fix to the default branch, and let Dependabot automatically generate a CVE from the merged commit.

Answer

Publish the security advisory first to reserve the CVE, then develop the fix in the public repository so contributors can help before releasing the patch.

Answer

File the report directly with MITRE for a CVE, then create a public draft PR in the repository so downstream users can review the change before merge.