{"id":5227,"date":"2026-10-05T18:50:35","date_gmt":"2026-10-05T18:50:35","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/10\/05\/github-slams-the-brakes-on-private-vulnerability-reports\/"},"modified":"2026-10-05T18:50:35","modified_gmt":"2026-10-05T18:50:35","slug":"github-slams-the-brakes-on-private-vulnerability-reports","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/10\/05\/github-slams-the-brakes-on-private-vulnerability-reports\/","title":{"rendered":"GitHub Slams the Brakes on Private Vulnerability Reports"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Drowning in AI-generated bug reports? GitHub has a radical answer: Stop accounts from reporting them.<\/span><\/p>\n

GitHub\u2019s new limits on bug reports<\/span><\/a> aren\u2019t a solution to the AI bug-report flood. Anything but! They\u2019re an admission that the traditional security-disclosure workflow, with human maintainers in the loop, simply doesn\u2019t scale. The scarce resource is no longer discovering security holes; it\u2019s informed human judgment.<\/span><\/p>\n

Specifically, <\/span>GitHub<\/span><\/a> has introduced daily rate limits on new private vulnerability reports. The goal is to give open-source maintainers breathing space to reduce the burden of low-quality and automated security submissions without closing off private disclosure channels to legitimate researchers.<\/span><\/p>\n

As GitHub said, and we all know, open-source maintainers are receiving an increasing number of reports that \u201cbury the reports that matter.\u201d These new restrictions respond to the flood of bulk and automated filings.<\/span><\/p>\n

As Dan Lorenc, co-founder and CEO of security company<\/span> Chainguard<\/span><\/a>, recently said in a webinar, AI is \u201cnow finding vulnerabilities in the software they write and the software they use at a pace that is far exceeding defenders\u2019 ability to patch and get updates and fix the vulnerabilities.\u201d <\/span><\/p>\n

He continued that it was always easier to find vulnerabilities than to fix them, but<\/span> AI has \u201cpoured another giant jug of gasoline onto the fire<\/span><\/a> before inventing a better fire extinguisher.\u201d<\/span><\/p>\n

While we\u2019re waiting for a better fire extinguisher, GitHub now caps how many reports a single account can file in a day both against a particular repository and across GitHub more broadly. Reporters who reach the threshold are instructed to try again later.<\/span><\/p>\n

What are those numbers? We don\u2019t know. GitHub hasn\u2019t published them. The only way to find out if you\u2019ve hit the limit is to slam into it. An AI bot mass-generating slop reports won\u2019t care. Serious security researchers using AI will doubtlessly be ticked off. <\/span><\/p>\n

These restrictions, however, don\u2019t extend to existing bug reports after they have been filed. Comments attached to existing private advisories remain available. This means maintainers and reporters can continue investigating a valid submission even if the reporter has reached the new-report limit.<\/span><\/p>\n

Repository administrators can also impose a custom daily overall reporting limit for their repositories and create an allow list for trusted reporters. The allow-list option lets maintainers exempt researchers, internal security staff, or established bug-bounty participants from the limits.<\/span><\/p>\n

The controls are available for public repositories that have <\/span>Private Vulnerability Reporting<\/span><\/a> enabled on GitHub Free, Pro, Team, and Enterprise Cloud. GitHub places the configuration under:<\/span><\/p>\n

Settings \u2192 Advanced Security \u2192 Private vulnerability reporting.<\/span><\/p>\n

Private Vulnerability Reporting enables researchers to privately disclose a security issue to a repository\u2019s maintainers rather than opening a public issue or immediately publishing technical details. GitHub says the channel enables maintainers to assess and address a finding before public disclosure.<\/span><\/p>\n

GitHub\u2019s new measure addresses volume rather than validity. It doesn\u2019t determine whether a report is technically sound, set service-level expectations for maintainer responses, or resolve disagreements between researchers and projects about severity or scope. Instead, it gives GitHub and individual repositories a way to cap incoming report creation while preserving ongoing communication on reports already in progress.<\/span><\/p>\n

That same day, GitHub also announced another change to improve report quality. That\u2019s <\/span>structured forms for private vulnerability reports<\/span><\/a>. Rather than relying entirely on one free-text field, maintainers can request information needed to assess a finding, including a reproducible proof of concept.<\/span><\/p>\n

Together, the form and rate-limit changes suggest GitHub is trying to improve the signal-to-noise ratio at the intake stage: For maintainers, the practical choice will be how aggressively to set repository-specific caps and whom to trust with an exemption. A low threshold may reduce noise but could create friction for productive researchers working across several related flaws. An overly permissive setting may leave the project with much the same triage load that prompted the new controls.<\/span><\/p>\n

AI may, however, eventually provide the answer. As Madelyn Olson, co-founder of <\/span>Valkey<\/span><\/a>, told me at <\/span>ValkeyConf<\/span><\/a> in Prague, \u201cWe\u2019ve created automated adversarial testing that looks for bugs and automated code reviews that generate pull requests (PR). Now, when you open a PR, we fine-tune a bot that looks for specific issues that are common in Valkey and is quite helpful at finding actual bugs.\u201d <\/span><\/p>\n

So, AI may have caused this problem, but with some work, it can also fix the problem<\/span><\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Drowning in AI-generated bug reports? GitHub has a radical answer: Stop accounts from reporting them. GitHub\u2019s new limits on bug […]<\/p>\n","protected":false},"author":1,"featured_media":5228,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-5227","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5227"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5227\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/5228"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}