Confidential comments on repository security advisories

You can now post confidential comments on repository security advisories. Confidential comments are visible only to people with write access to the repository, so you can discuss a report with your team without the reporter or other invited collaborators seeing it.

Previously, every comment on an advisory was visible to all of its collaborators, including the reporter. To discuss suspected abuse, investigation details, or coordination notes, you had to move the conversation somewhere else and lose it from the advisory’s history.

With this update:

• Select Confidential. Only maintainers will see this comment below the comment box before you post.
• Confidential comments are clearly marked in the advisory timeline.
• Reporters and invited collaborators without write access can’t see confidential comments and aren’t notified about them.
• Access follows current repository permissions. If someone loses write access, they can no longer read confidential comments.
• Views of confidential comments are recorded in the audit log.

You can’t switch a comment between confidential and regular after you post it. Confidential comments are available in the GraphQL API, but they aren’t returned by the REST API.

This is available for public repositories with private vulnerability reporting enabled on GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud.

Learn more about repository security advisories.