Implementing GitHub's private security issue reporting
summary
Mautic shifts a monthlong security intake into GitHub Security Advisories, enabling private temporary forks for sandboxed fixes and a one-click merge to all branches for multi‑version patches; historical advisories take about three weeks to import. The workflow works for triage, contributor crediting, CVE/CNA publishing and quarterly security releases, but 5% of gaps remain: GitHub Actions don’t run in private forks so a separate private repo is kept for CI, and teams can’t be auto‑assigned to advisories yet.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:47Security process before zero day
- 3:55Switching tools after acquisition
- 6:20GitHub security advisories explored
- 9:50Private forks for collaboration
- 12:21Migrating historical advisories
- 14:07Current limitations and workarounds
- 16:58Improvements and new workflows
- 19:26Community response and benefits
- 20:52Q&A
related talks
21mOpen source security: advisories and workflows to keep open source secure
27mBuilding a Secure Open Source Project on GitHub
41mBake Security into your workflow with GitHub Advanced Security and AI
30mSecuring the software supply chain together
48mAdvanced Security with GitHub without GitHub Advanced Security
39mDon’t Ignore Those GitHub Security Alerts. Automate Them Into your Workflow
31mA Glimpse Into OSS Vulnerability Disclosure Practices
56mHow to use GitHub Actions with Security in mind