In September 2019, alongside its acquisition of code analysis company Semmle, GitHub announced a set of security workflow improvements aimed at making it easier for maintainers and developers to handle vulnerability disclosure and remediation. The most significant change: GitHub became a CVE Numbering Authority (CNA) for open source projects, enabling maintainers to request a CVE identifier directly from the GitHub UI.
Private Security Advisories: A Safe Space for Disclosure
When a project maintainer or anyone with admin privileges on a repository discovers a vulnerability, they can now create a draft security advisory inside GitHub. These advisories provide a private, controlled environment to discuss the vulnerability and coordinate a fix before any public disclosure.
Security advisories are private by default, regardless of whether the repository itself is public or private. Access can be restricted to specific collaborators, giving maintainers fine-grained control over who is aware of the issue during the remediation period.
Temporary Private Forks for Safe Patch Development
One of the most practically useful features introduced is the ability to create a temporary private fork of a repository directly from within a security advisory. This allows developers to write, review, and test a fix without accidentally leaking vulnerability details to the public — for example, through a public pull request or a CI build log.
To prevent unintended exposure, temporary private forks are explicitly excluded from continuous integration pipelines and other repository integrations. Once the fix is ready, a pull request can be created from the private fork and merged into the main branch, all without leaving the security advisory workflow.
Everything Under a Unified Security Tab
All of these capabilities are grouped under a dedicated Security tab in the GitHub repository UI. From this single location, maintainers can:
- Create and manage a security advisory
- Spin up a temporary private fork
- Open a pull request with the fix
- Merge the fix into the main branch
- Request and assign a CVE identifier
This consolidation reduces the context-switching that previously forced maintainers to juggle GitHub, email threads, and external CVE request processes simultaneously.
GitHub as a CVE Numbering Authority
The CVE (Common Vulnerabilities and Exposures) system, operated by the MITRE Corporation, provides a standardized way to uniquely identify and reference security vulnerabilities. Having a CVE identifier is important even before a fix is available — it allows security researchers, vendors, and users to refer to the same issue unambiguously across advisories, patch notes, and security bulletins.
By becoming a CNA, GitHub can now issue CVE identifiers directly for vulnerabilities reported through its security advisory workflow. Previously, maintainers had to request a CVE through a separate process with MITRE or another CNA, which added friction and delay to coordinated disclosure. Integrating this step into the GitHub UI removes that barrier for open source projects hosted on the platform.
GitHub’s Broader Security Ecosystem
The security advisory and CNA announcements are part of a longer trajectory of security features GitHub has added to the platform:
- Vulnerability alerts: GitHub notifies maintainers when known vulnerabilities are detected in a project’s dependencies.
- Dependabot automatic security PRs: Introduced in the months before this announcement, Dependabot scans project dependencies and automatically opens pull requests to update any that have known vulnerabilities.
- Token scanning: GitHub scans commits pushed to public repositories for accidentally committed secrets — such as API tokens and cryptographic keys — and alerts the relevant service provider.
Together, these features represent GitHub’s effort to shift security practices left — making it easier to catch and remediate vulnerabilities earlier in the development lifecycle, directly within the tools developers already use every day.
Availability
At the time of the announcement in September 2019, maintainer security advisories were available as a public beta. Developers and maintainers hosting open source projects on GitHub were encouraged to try the feature and provide feedback through the beta period.