{"meta":{"title":"Creating a repository security advisory","intro":"You can create a draft security advisory to privately discuss and fix a security vulnerability in your open source project.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/how-tos","title":"How-tos"},{"href":"/en/code-security/how-tos/report-and-fix-vulnerabilities","title":"Report and fix vulnerabilities"},{"href":"/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities","title":"Fix vulnerabilities"},{"href":"/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/creating-a-repository-security-advisory","title":"Create repository advisory"}],"documentType":"article"},"body":"# Creating a repository security advisory\n\nYou can create a draft security advisory to privately discuss and fix a security vulnerability in your open source project.\n\n> \\[!NOTE]\n> If you are a security researcher, you should directly contact maintainers to ask them to create security advisories or issue CVEs on your behalf in repositories that you don't administer. However, if private vulnerability reporting is enabled for the repository, you can *privately* report a vulnerability yourself. For more information, see [Privately reporting a security vulnerability](/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability).\n\n## Creating a security advisory\n\nYou can also use the REST API to create repository security advisories. For more information, see [REST API endpoints for repository security advisories](/en/rest/security-advisories/repository-advisories).\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under the repository name, click the ** Security and quality** tab. If you cannot see the \" Security and quality\" tab, select the **** dropdown menu, and then click ** Security and quality**.\n3. In the left sidebar, under \"Reporting\", click ** Advisories**.\n4. Click **New draft security advisory** to open the draft advisory form. The fields marked with an asterisk are required.\n5. In the **Title** field, type a title for your security advisory.\n6. Use the **CVE identifier** dropdown menu to specify whether you already have a CVE identifier or plan to request one from GitHub later. If you have an existing CVE identifier, select **I have an existing CVE identifier** to display an **Existing CVE** field, and type the CVE identifier in the field. For more information, see [About repository security advisories](/en/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories#cve-identification-numbers).\n7. In the **Description** field, type a description of the security vulnerability including its impact, any patches or workarounds available, and any references.\n8. Under \"Affected products\", define the ecosystem, package name, affected/patched versions, and vulnerable functions for the security vulnerability that this security advisory describes. If applicable, you can add multiple affected products to the same advisory by clicking **Add another affected product**.\n\n For information about how to specify information on the form, including affected versions, see [Best practices for writing repository security advisories](/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/best-practices-for-writing-repository-security-advisories).\n9. Define the severity of the security vulnerability using the **Severity** dropdown menu. If you want to calculate a CVSS score, select **Assess severity using CVSS** and then select the appropriate values in the **Calculator**. GitHub calculates the score according to the [Common Vulnerability Scoring System Calculator](https://www.first.org/cvss/calculator).\n10. Under \"Weaknesses\", in the **Common weakness enumerator** field, type common weakness enumerators (CWEs) that describe the kinds of security weaknesses that this security advisory reports. For a full list of CWEs, see the [Common Weakness Enumeration](https://cwe.mitre.org/index.html) from MITRE.\n11. Optionally, under \"Credits\", add credits by searching for a GitHub username, the email address associated with their GitHub account, or their full name.\n\n * Use the dropdown menu next to the name of the person you're crediting to assign a credit type. For more information about credit types, see the [About credits for repository security advisories](#about-credits-for-repository-security-advisories) section.\n\n \n\n * Optionally, to remove someone, click next to the credit type.\n12. Click **Create draft security advisory**.\n\nThe people listed in the \"Credits\" section will receive an email or web notification inviting them to accept credit. If a person accepts, their username will be publicly visible once the security advisory is published.\n\n### About credits for repository security advisories\n\nYou can credit people who helped discover, report, or fix a security vulnerability. If you credit someone, they can choose to accept or decline credit.\n\nYou can assign different types of credit to people.\n\n| Credit type | Reason |\n| --------------------- | ------------------------------------------------------------------------------------------ |\n| Finder | Identifies the vulnerability |\n| Reporter | Notifies the vendor of the vulnerability to a CNA |\n| Analyst | Validates the vulnerability to ensure accuracy or severity |\n| Coordinator | Facilitates the coordinated response process |\n| Remediation developer | Prepares a code change or other remediation plans |\n| Remediation reviewer | Reviews vulnerability remediation plans or code changes for effectiveness and completeness |\n| Remediation verifier | Tests and verifies the vulnerability or its remediation |\n| Tool | Names of tools used in vulnerability discovery or identification |\n| Sponsor | Supports the vulnerability identification or remediation activities |\n\nIf someone accepts credit, the person's username appears in the \"Credits\" section of the security advisory. Anyone with read access to the repository can see the advisory and the people who accepted credit for it.\n\n> \\[!NOTE]\n> If you believe you should be credited for a security advisory, please contact the creator of the advisory and to ask for the advisory to be edited to include your credit. Only the creator of the advisory can credit you, so please don't contact GitHub Support about credits for security advisories.\n\n## Next steps\n\n* Comment on the draft security advisory to discuss the vulnerability with your team.\n* Add collaborators to the security advisory. For more information, see [Adding a collaborator to a repository security advisory](/en/code-security/security-advisories/working-with-repository-security-advisories/adding-a-collaborator-to-a-repository-security-advisory).\n* Privately collaborate to fix the vulnerability in a temporary private fork. For more information, see [Collaborating in a temporary private fork to resolve a repository security vulnerability](/en/code-security/security-advisories/working-with-repository-security-advisories/collaborating-in-a-temporary-private-fork-to-resolve-a-repository-security-vulnerability).\n* Add individuals who should receive credit for contributing to the security advisory. For more information, see [Editing a repository security advisory](/en/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory#about-credits-for-security-advisories).\n* Publish the security advisory to notify your community of the security vulnerability. For more information, see [Publishing a repository security advisory](/en/code-security/security-advisories/working-with-repository-security-advisories/publishing-a-repository-security-advisory)."}