Use the repository’s private vulnerability channel before sharing reproduction details

A security policy and an enabled private-reporting form are related but separate repository settings.

Source facts

GitHub private vulnerability reporting is separate from SECURITY.md and must be enabled for a public repository before its private form can be used. The reporting form displays an existing security policy for review. Where private reporting is unavailable, GitHub directs reporters to follow the repository’s policy or ask maintainers for a preferred security contact. Reports are intended to provide enough detail for assessment and reproduction.

Source: GitHub — Privately reporting a security vulnerability.

Applicability

This concerns GitHub’s reporting workflow. It does not authorize testing a system, publishing exploit details or assuming a maintainer has promised any response deadline.

DSE recommendation

DSE recommends identifying the exact repository and reading its disclosure instructions before transmitting sensitive findings. Prepare a concise impact description and minimal reproduction using only information the reporter is authorized to share. Keep credentials, customer data and unnecessary exploit detail out of a public contact request. Assign a tracking owner and preserve the private correspondence through the organization’s approved handling process. Keep a safe public contact request ready that asks only for the preferred reporting route. Have the reporting owner confirm repository identity and disclosure instructions before sharing reproduction material, and track the private submission separately from any later publication decision.

Verification

Proposed verification: review the available reporting route without submitting a test report to unrelated maintainers. In a repository the organization owns, verify the configured policy and private form visibility. Confirm the team can receive and triage a permitted internal exercise, and document where real reports should be tracked and escalated.

Official reference

GitHub — Privately reporting a security vulnerability. Reviewed October 20, 2026.