Privately report vulnerabilities to repository maintainers

Open source maintainers can now opt-in to private vulnerability reporting, a dedicated communications channel where the community can disclose security issues directly to you on GitHub.

You can see reports sent to you under the new "Needs triage" status on your advisories list:

If the report is accepted, it becomes a draft security advisory. The reporter remains involved unless explicitly removed, so you can collaborate on phrasing the resulting draft advisory or fixing the issue in a private fork.

• Learn how to enable private vulnerability reporting
• Learn more about managing vulnerabilities reported to you
• Learn more about reporting a vulnerability to others
• Learn more about GitHub security advisories for repositories