# Use the repository’s private vulnerability channel before sharing reproduction details

> A security policy and an enabled private-reporting form are related but separate repository settings.

- Canonical URL: https://update.dsesecurity.com/updates/github-private-vulnerability-reporting-policy-channel/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:30+00:00
- Modified: 2026-10-20T18:34:31+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

A security policy and an enabled private-reporting form are related but separate repository settings.

## Potentially affected

This concerns GitHub’s reporting workflow. It does not authorize testing a system, publishing exploit details or assuming a maintainer has promised any response deadline.

## DSE recommendation

DSE recommends identifying the exact repository and reading its disclosure instructions before transmitting sensitive findings.

## Article

A security policy and an enabled private-reporting form are related but separate repository settings.

## Source facts

GitHub private vulnerability reporting is separate from SECURITY.md and must be enabled for a public repository before its private form can be used. The reporting form displays an existing security policy for review. Where private reporting is unavailable, GitHub directs reporters to follow the repository’s policy or ask maintainers for a preferred security contact. Reports are intended to provide enough detail for assessment and reproduction.

Source: [GitHub — Privately reporting a security vulnerability](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately).

## Applicability

This concerns GitHub’s reporting workflow. It does not authorize testing a system, publishing exploit details or assuming a maintainer has promised any response deadline.

## DSE recommendation

DSE recommends identifying the exact repository and reading its disclosure instructions before transmitting sensitive findings. Prepare a concise impact description and minimal reproduction using only information the reporter is authorized to share. Keep credentials, customer data and unnecessary exploit detail out of a public contact request. Assign a tracking owner and preserve the private correspondence through the organization’s approved handling process. Keep a safe public contact request ready that asks only for the preferred reporting route. Have the reporting owner confirm repository identity and disclosure instructions before sharing reproduction material, and track the private submission separately from any later publication decision.

## Verification

Proposed verification: review the available reporting route without submitting a test report to unrelated maintainers. In a repository the organization owns, verify the configured policy and private form visibility. Confirm the team can receive and triage a permitted internal exercise, and document where real reports should be tracked and escalated.

## Official reference

[GitHub — Privately reporting a security vulnerability](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately). Reviewed October 20, 2026.

## Primary reference

- Name: GitHub — Privately reporting a security vulnerability
- Authority: docs.github.com
- URL: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use the repository’s private vulnerability channel before sharing reproduction details,” DSE Security, https://update.dsesecurity.com/updates/github-private-vulnerability-reporting-policy-channel/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.