{"meta":{"title":"Configuring private vulnerability reporting for a repository","intro":"Owners and administrators of public repositories can allow security researchers to report vulnerabilities securely in the repository by enabling private vulnerability reporting.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/how-tos","title":"How-tos"},{"href":"/en/code-security/how-tos/report-and-fix-vulnerabilities","title":"Report and fix vulnerabilities"},{"href":"/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting","title":"Configure vulnerability reporting"},{"href":"/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configuring-private-vulnerability-reporting-for-a-repository","title":"Configure for a repository"}],"documentType":"article"},"body":"# Configuring private vulnerability reporting for a repository\n\nOwners and administrators of public repositories can allow security researchers to report vulnerabilities securely in the repository by enabling private vulnerability reporting.\n\nEnabling private vulnerability reporting gives security researchers a secure, structured way to disclose vulnerabilities directly in your repository. Once enabled, researchers can submit reports through without resorting to public disclosure or informal channels. For background on private vulnerability reporting and how it fits into coordinated disclosure, see [About coordinated disclosure of security vulnerabilities](/en/code-security/concepts/vulnerability-reporting-and-management/about-coordinated-disclosure-of-security-vulnerabilities).\n\nThe instructions in this article refer to enablement at repository level. For information about enabling the feature at organization level, see [About coordinated disclosure of security vulnerabilities](/en/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-an-organization).\n\n## Enabling or disabling private vulnerability reporting for a repository\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under your repository name, click ** Settings**. If you cannot see the \"Settings\" tab, select the **** dropdown menu, then click **Settings**.\n\n \n3. In the \"Security\" section of the sidebar, click ** Advanced Security**.\n4. Under \"Advanced Security\", to the right of \"Private vulnerability reporting\", click **Enable** or **Disable**, to enable or disable the feature, respectively.\n \n\nWhen private vulnerability reporting is enabled, security researchers see a **Report a vulnerability** button on the repository’s \"Advisories\" page, which allows them to submit a private report.\n\n\n\nSecurity researchers can also use the REST API to privately report security vulnerabilities. See [REST API endpoints for repository security advisories](/en/rest/security-advisories/repository-advisories#privately-report-a-security-vulnerability).\n\n## Configuring notifications for private vulnerability reporting\n\nWhen a new vulnerability is privately reported in a repository, GitHub notifies repository administrators and security managers if:\n\n* They're watching the repository for all activity or are subscribed to “Security alerts” notifications.\n* They have notifications enabled for the repository.\n\nNotifications depend on the user's notification preferences. You will receive an email notification if:\n\n* You are watching the repository with **All Activity** selected, or with **Security alerts** (available under **Custom**) selected.\n* In your notification settings, under **Subscriptions**, then under **Watching**, you have selected to receive notifications by email.\n\n1. On GitHub, navigate to the main page of the repository.\n\n2. To start watching the repository, select ** Watch**.\n\n \n\n3. In the dropdown menu, select **All Activity** to receive notifications for all activity, or select **Custom**, then **Security alerts** to receive notifications only for security alerts.\n\n4. Navigate to the notification settings for your personal account. These are available at [https://github.com/settings/notifications](https://github.com/settings/notifications?ref_product=security-advisories\\&ref_type=engagement\\&ref_style=text).\n\n5. On your notification settings page, under \"Subscriptions,\" then under \"Watching,\" click the **Notify me** dropdown.\n\n6. Select \"Email\" as a notification option, then click **Save**.\n\n \n\nFor more information about setting up notification preferences, see [Managing security and analysis settings for your repository](/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository#granting-access-to-security-alerts) and [Configuring your watch settings for an individual repository](/en/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications#configuring-your-watch-settings-for-an-individual-repository)."}